AWS solutions documentation change
Summary
Updated authentication method from IAM Roles for Service Accounts (IRSA) to EKS Pod Identity for Migration Console and Argo workflow pods
Security assessment
The change documents a newer authentication mechanism (EKS Pod Identity) that continues to avoid long-lived credentials. While security-related (credentials management), there's no evidence this fixes a vulnerability - it appears to be a documentation update for a feature improvement.
Diff
diff --git a/solutions/latest/migration-assistant-for-amazon-opensearch-service/architecture-details.md b/solutions/latest/migration-assistant-for-amazon-opensearch-service/architecture-details.md index 6972421c5..801caa9a7 100644 --- a//solutions/latest/migration-assistant-for-amazon-opensearch-service/architecture-details.md +++ b//solutions/latest/migration-assistant-for-amazon-opensearch-service/architecture-details.md @@ -41 +41 @@ AWS service | Description -[AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/) | **Supporting.** Provides [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) used by the Migration Console and Argo workflow executor pods to authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services without long-lived credentials. +[AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/) | **Supporting.** Provides the IAM role used by the Migration Console and Argo workflow executor pods through [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) to authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services without long-lived credentials. @@ -52 +52 @@ The control plane manages migration workflows. It runs on Amazon EKS and include -The Migration Console is a Kubernetes pod (`migration-console-0`) on Amazon EKS that provides the operator interface for the Migration Assistant for Amazon OpenSearch Service solution. It hosts the Workflow CLI and the `console` command-line tools used to inspect or manually drive individual migration components during validation and troubleshooting. The Migration Console pod runs under the `migration-console-access-role` Kubernetes service account, which is associated with an IAM role through IRSA so the console can authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services without long-lived credentials. The default Amazon S3 migrations bucket is mounted on the console for direct artifact access. +The Migration Console is a Kubernetes pod (`migration-console-0`) on Amazon EKS that provides the operator interface for the Migration Assistant for Amazon OpenSearch Service solution. It hosts the Workflow CLI and the `console` command-line tools used to inspect or manually drive individual migration components during validation and troubleshooting. The Migration Console pod runs under the `migration-console-access-role` Kubernetes service account, which is associated with an IAM role through [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) so the console can authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services without long-lived credentials. The default Amazon S3 migrations bucket is mounted on the console for direct artifact access. @@ -60 +60 @@ The Workflow CLI is the customer-facing interface for configuring, submitting, a -The workflow engine sequences migration tasks, retries failures, tracks state, and pauses at approval gates. It runs as Argo Workflows on Amazon EKS. The Argo workflow executor pods run under the `argo-workflow-executor` Kubernetes service account, which is associated with an IAM role through IRSA so workflow steps can authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services as the workflow runs. +The workflow engine sequences migration tasks, retries failures, tracks state, and pauses at approval gates. It runs as Argo Workflows on Amazon EKS. The Argo workflow executor pods run under the `argo-workflow-executor` Kubernetes service account, which is associated with an IAM role through [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) so workflow steps can authenticate to Amazon OpenSearch Service, Amazon OpenSearch Serverless, and other AWS services as the workflow runs.