> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SeekrFlow cloud identity

> Create the role or managed identity SeekrFlow uses to reach your cloud services.

Create the identity SeekrFlow's own pods use to reach your cloud services, such as object storage, OpenSearch, and your secret store. It's separate from the roles you created for Amazon Elastic Kubernetes Service (Amazon EKS), the nodes, and the cluster add-ons. Those roles only let each component do its own work. For every role in a deployment, see [Security considerations](/self-managed/flow/security#aws-iam-roles). You connect this identity to SeekrFlow's service accounts during configuration.

<Note>
  Skip this page for on-premises deployments. Storage credentials come from a Kubernetes secret, and on-premises deployments don't use cloud identity.
</Note>

## Choose a method

On Amazon Web Services (AWS), choose one of these methods:

| Method | How it works |
| - | - |
| Amazon EKS Pod Identity (recommended) | Amazon EKS associates the role with SeekrFlow's service accounts. The service accounts don't need annotations. |
| AWS Identity and Access Management (IAM) roles for service accounts | Each service account carries an annotation with the role's Amazon Resource Name (ARN). |

## Create the identity

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    Create an IAM role for SeekrFlow. Attach a permission policy that grants the permissions in this table, with the scope each row lists.

    | Service | Actions | Scope | When needed |
    | - | - | - | - |
    | Amazon Simple Storage Service (Amazon S3) | `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:GetObjectAttributes`, `s3:GetObjectVersion` | Objects in your SeekrFlow bucket, such as `arn:aws:s3:::<bucket-name>/*` | Always |
    | Amazon S3 | `s3:ListBucket` | Your SeekrFlow bucket, such as `arn:aws:s3:::<bucket-name>` | Always |
    | AWS License Manager | `license-manager:ListReceivedLicenses`, `license-manager:GetLicense` | `*`. License Manager doesn't support resource-level scoping. | Always |
    | AWS Secrets Manager | `secretsmanager:GetSecretValue` | Secrets under `seekrflow/*` | If you store secrets in Secrets Manager |
    | AWS Systems Manager Parameter Store | `ssm:GetParameter`, `ssm:GetParameters`, `ssm:GetParametersByPath`, `ssm:GetParameterHistory` | Parameters under `seekrflow/*` | If you store secrets in Parameter Store |
    | AWS Key Management Service (AWS KMS) | `kms:Decrypt`, with the condition `kms:ViaService` set to `ssm.<region>.amazonaws.com` | The key that encrypts your SecureString parameters | If you store secrets as SecureString parameters |
    | Amazon OpenSearch Service | `es:ESHttp*` | Your domain, such as `arn:aws:es:<region>:<account-id>:domain/<domain-name>/*` | If you use Amazon OpenSearch Service |
    | Amazon Bedrock | `bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream` | The inference profile ARNs and foundation model ARNs you use. A cross-Region inference profile also needs the model ARN in each Region the profile routes to. | If Amazon Bedrock serves any of your models |

    In AWS GovCloud (US), ARNs use the `aws-us-gov` partition, such as `arn:aws-us-gov:s3:::<bucket-name>`.

    The role's trust policy depends on your method:

    * **Amazon EKS Pod Identity** – Trust the `pods.eks.amazonaws.com` service principal, with the `sts:AssumeRole` and `sts:TagSession` actions. See [Create IAM role with trust policy required by EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-role.html). During configuration, `sfe cloud-identity aws` updates the trust policy and creates a Pod Identity association for each SeekrFlow service account.
    * **IAM roles for service accounts** – Trust your cluster's OpenID Connect (OIDC) provider. `sfe cloud-identity aws` doesn't configure this method. See [IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
  </Tab>
</Tabs>

## Record the values

Note these values. You will enter them when you create the values file.

| Value | Used for | Example or format |
| - | - | - |
| Role ARN, IAM roles for service accounts only | `global.cloudProvider.identity` annotation `eks.amazonaws.com/role-arn` | `arn:aws:iam::123456789012:role/seekrflow`. For Amazon EKS Pod Identity, leave `global.cloudProvider.identity` as `{}`. Setting the role ARN switches SeekrFlow's workflow pods to IAM roles for service accounts, which fails without an OIDC provider. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.