EKS Pod调用AssumeRoleWithWebIdentity遇AccessDenied错误求助

按照AWS EKS Pod绑定IAM角色的指南操作至第五步时失败，报错：

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity
command terminated with exit code 254

需求是让reporting-analytics-services-kafka-tools命名空间下Pod内的boto3客户端执行EC2相关操作，已确认Pod能正常获取AWS环境变量，怀疑是IAM角色、K8s配置或ARN匹配问题。

现有配置信息 #

IAM角色信任策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_number>:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>:sub": "system:serviceaccount:reporting-analytics-services-kafka-tools:",
                    "oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

IAM权限策略（已附加至角色）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:*",
                "sts:*",
                "ec2:describeInstances",
                "ec2:stopInstances",
                "ec2:startInstances",
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

K8s部署清单

---
# Source: kafka-tools-pod/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    app: test-pod
  name: test-pod
  namespace: reporting-analytics-services-kafka-tools
spec:
  ports:
    - port: 8080
  selector:
    app: test-pod
---
# Source: kafka-tools-pod/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test-pod
  name: test-pod
  namespace: reporting-analytics-services-kafka-tools
spec:
  replicas: 3
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: test-pod
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: test-pod
      annotations:
        Error: "invalid character '$' looking for beginning of value"
    spec:
      serviceAccountName: kafka-tools-pod-service-account
      containers:
        - envFrom:
            - configMapRef:
                name: kafka-tools-pod-env
          image: <somenumber>.dkr.ecr.us-east-1.amazonaws.com/kafka-testing:latest
          imagePullPolicy: IfNotPresent
          name: test-pod
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: 1500m
              memory: 3Gi
            requests:
              cpu: 350m
              memory: 128Mi
---
# Source: kafka-tools-pod/templates/ingress-internal.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: internal-nginx
  name: kafka-tools-pod-internal
  namespace: reporting-analytics-services-kafka-tools
spec:
  rules:
    - host: mycompany.use1.develop.percipio.aws
      http:
        paths:
          - backend:
              service:
                name: test-pod
                port:
                  number: 8080
            path: /
            pathType: Prefix
---
# Source: kafka-tools-pod/templates/verticalpodautoscaler.yaml
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  labels:
    app: test-pod
  name: test-pod
  namespace: reporting-analytics-services-kafka-tools
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: test-pod
  updatePolicy:
    updateMode: 'Off'
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kafka-tools-pod-service-account
  namespace: reporting-analytics-services-kafka-tools
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<myaccount>:role/kafka-nodes-reboot-role
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kakfa-tools-pod-role
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["extensions"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["apps"]
  resources: ["*"]
  verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kakfa-tools-pod-role-binding
subjects:
- kind: ServiceAccount
  name: kafka-tools-pod-service-account
  namespace: reporting-analytics-services-kafka-tools
roleRef:
  kind: Role
  name: kakfa-tools-pod-role
  apiGroup: rbac.authorization.k8s.io

核心问题：IAM角色信任策略的sub条件配置错误 #

你的IAM角色信任策略中，sub字段末尾多了一个冒号，且缺少具体的服务账户名称。正确的sub格式必须是system:serviceaccount:<命名空间>:<服务账户名>，修正后的信任策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_number>:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>:sub": "system:serviceaccount:reporting-analytics-services-kafka-tools:kafka-tools-pod-service-account",
                    "oidc.eks.us-east-1.amazonaws.com/id/<oidc_number>:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

其他需要验证的配置点 #

1. 服务账户ARN匹配：确认ServiceAccount的eks.amazonaws.com/role-arn注释中的ARN，与IAM角色的ARN完全一致（账户ID、角色名称不能有拼写错误）。
2. OIDC提供商一致性：检查IAM中配置的EKS OIDC提供商URL，与角色信任策略里的Federated ARN、Condition中的OIDC域名完全匹配（区域、OIDC ID必须对应）。
3. 清理无效YAML注释：Deployment模板中metadata.annotations里的Error: "invalid character '$' looking for beginning of value"是无效内容，建议删除，避免YAML解析异常导致Pod启动或配置加载失败。
4. RBAC权限说明：你配置的K8s RBAC是集群内部权限，和AWS STS的AssumeRole操作无关，无需调整。

验证操作步骤 #

1. 更新IAM角色的信任策略后，重启Deployment让Pod应用新配置：

kubectl rollout restart deployment test-pod -n reporting-analytics-services-kafka-tools

2. 进入Pod测试boto3的EC2调用是否正常：

kubectl exec -it <你的Pod名称> -n reporting-analytics-services-kafka-tools -- python3 -c "import boto3; ec2 = boto3.client('ec2'); print(ec2.describe_instances()['Reservations'][:1])"

内容的提问来源于stack exchange，提问作者noblerthanoedipus