Set up SeekrFlow cloud identity

Create the identity SeekrFlow’s own pods use to reach your cloud services, such as object storage, OpenSearch, and your secret store. It’s separate from the roles you created for Amazon Elastic Kubernetes Service (Amazon EKS), the nodes, and the cluster add-ons. Those roles only let each component do its own work. For every role in a deployment, see Security considerations. You connect this identity to SeekrFlow’s service accounts during configuration.

Skip this page for on-premises deployments. Storage credentials come from a Kubernetes secret, and on-premises deployments don’t use cloud identity.

Choose a method

On Amazon Web Services (AWS), choose one of these methods:

Method	How it works
Amazon EKS Pod Identity (recommended)	Amazon EKS associates the role with SeekrFlow’s service accounts. The service accounts don’t need annotations.
AWS Identity and Access Management (IAM) roles for service accounts	Each service account carries an annotation with the role’s Amazon Resource Name (ARN).

Create the identity

Amazon Web Services (AWS)

Create an IAM role for SeekrFlow. Attach a permission policy that grants the permissions in this table, with the scope each row lists.

Service	Actions	Scope	When needed
Amazon Simple Storage Service (Amazon S3)	`s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:GetObjectAttributes`, `s3:GetObjectVersion`	Objects in your SeekrFlow bucket, such as `arn:aws:s3:::<bucket-name>/*`	Always
Amazon S3	`s3:ListBucket`	Your SeekrFlow bucket, such as `arn:aws:s3:::<bucket-name>`	Always
AWS License Manager	`license-manager:ListReceivedLicenses`, `license-manager:GetLicense`	`*`. License Manager doesn’t support resource-level scoping.	Always
AWS Secrets Manager	`secretsmanager:GetSecretValue`	Secrets under `seekrflow/*`	If you store secrets in Secrets Manager
AWS Systems Manager Parameter Store	`ssm:GetParameter`, `ssm:GetParameters`, `ssm:GetParametersByPath`, `ssm:GetParameterHistory`	Parameters under `seekrflow/*`	If you store secrets in Parameter Store
AWS Key Management Service (AWS KMS)	`kms:Decrypt`, with the condition `kms:ViaService` set to `ssm.<region>.amazonaws.com`	The key that encrypts your SecureString parameters	If you store secrets as SecureString parameters
Amazon OpenSearch Service	`es:ESHttp*`	Your domain, such as `arn:aws:es:<region>:<account-id>:domain/<domain-name>/*`	If you use Amazon OpenSearch Service
Amazon Bedrock	`bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`	The inference profile ARNs and foundation model ARNs you use. A cross-Region inference profile also needs the model ARN in each Region the profile routes to.	If Amazon Bedrock serves any of your models

In AWS GovCloud (US), ARNs use the aws-us-gov partition, such as arn:aws-us-gov:s3:::<bucket-name>.The role’s trust policy depends on your method:

Amazon EKS Pod Identity – Trust the pods.eks.amazonaws.com service principal, with the sts:AssumeRole and sts:TagSession actions. See Create IAM role with trust policy required by EKS Pod Identity. During configuration, sfe cloud-identity aws updates the trust policy and creates a Pod Identity association for each SeekrFlow service account.
IAM roles for service accounts – Trust your cluster’s OpenID Connect (OIDC) provider. sfe cloud-identity aws doesn’t configure this method. See IAM roles for service accounts.

Record the values

Note these values. You will enter them when you create the values file.

Value	Used for	Example or format
Role ARN, IAM roles for service accounts only	`global.cloudProvider.identity` annotation `eks.amazonaws.com/role-arn`	`arn:aws:iam::123456789012:role/seekrflow`. For Amazon EKS Pod Identity, leave `global.cloudProvider.identity` as `{}`. Setting the role ARN switches SeekrFlow’s workflow pods to IAM roles for service accounts, which fails without an OIDC provider.

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference

Choose a method

Create the identity

Record the values

​Choose a method

​Create the identity

​Record the values

Choose a method

Create the identity

Record the values