This blog will guide you through setting up an Amazon EKS cluster, integrating AWS Secrets Manager, and deploying a sample application to demonstrate secure secret retrieval.

Step 1: Set Up an Amazon EKS Cluster

1. Create the EKS Cluster

Run the following command to create an EKS cluster:

eksctl create cluster \ –name demo-eks-cluster \ –region us-east-1 \ –nodegroup-name std-workers \ –node-type t3.medium \ –nodes 2 \ –nodes-min 1 \ –nodes-max 3 \ –managed

This command creates an EKS cluster with a managed node group in the us-east-1 region.

2. Verify the Cluster

Ensure the cluster was created successfully:

eksctl get cluster –region us-east-1

3. Update kubeconfig

Update the kubeconfig file to connect kubectl to your EKS cluster:

aws eks –region us-east-1 update-kubeconfig –name demo-eks-cluster

4. Verify Node Readiness

Check if the worker nodes are ready:

kubectl get nodes

You should see the nodes in the Ready state.

Step 2: Store Secrets in AWS Secrets Manager

1. Create a Secret

Example: RambunctDatabaseSecret

2. Copy the Secret ARN

After saving the secret, copy the ARN for use in the IAM role permissions.

Step 3: Enable IAM Roles for Service Accounts (IRSA)

1. Associate OIDC Provider

Enable IAM Roles for Service Accounts (IRSA) by associating an OIDC provider with your cluster:

eksctl utils associate-iam-oidc-provider –region us-east-1 –cluster demo-eks-cluster –approve

2. Verify OIDC Provider

Check if the OIDC provider is correctly associated:

aws eks describe-cluster –name demo-eks-cluster –query “cluster.identity.oidc.issuer” –output text

The output should resemble:

https://oidc.eks.us-east-1.amazonaws.com/id/

Step 4: Create IAM Role with Secret Access

1. Create IAM Policy

Save the following JSON policy as secrets-access-policy.json:

{ “Version”: “2012-10-17”, “Statement”: [ { “Effect”: “Allow”, “Action”: [ “secretsmanager:ListSecrets”, “secretsmanager:GetSecretValue” ], “Resource”: [ “arn:aws:secretsmanager:us-east-1::secret:RambunctDatabaseSecret*” ] } ] }

Replacewith your AWS account ID.

2. Create IAM Role

1. Save this trust policy as trust-policy.json:

{ “Version”: “2012-10-17”, “Statement”: [ { “Effect”: “Allow”, “Principal”: { “Federated”: “arn:aws:iam:::oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/” }, “Action”: “sts:AssumeRoleWithWebIdentity”, “Condition”: { “StringEquals”: { “oidc.eks.us-east-1.amazonaws.com/id/:sub”: “system:serviceaccount:default:my-app-sa” } } } ] }

2. Create the role and attach the policy:

aws iam create-role –role-name eks-secret-access-role \ –assume-role-policy-document file://trust-policy.json aws iam put-role-policy –role-name eks-secret-access-role \ –policy-name secrets-access-policy \ –policy-document file://secrets-access-policy.json

Step 5: Create Kubernetes Service Account

1. Save the following YAML as service-account.yaml:

apiVersion: v1 kind: ServiceAccount metadata: name: my-app-sa namespace: default annotations: eks.amazonaws.com/role-arn: arn:aws:iam:::role/eks-secret-access-role

2. Apply the service account:

kubectl apply -f service-account.yaml

Step 6: Deploy the Application

1. Create Python Script

Save the following script as app.py:

import boto3 import json def get_secret(secret_name, region_name=”us-east-1″): client = boto3.client(“secretsmanager”, region_name=region_name) try: response = client.get_secret_value(SecretId=secret_name) return response[“SecretString”] if “SecretString” in response else response[“SecretBinary”] except Exception as e: print(f”Error retrieving secret: {e}”) return None if __name__ == “__main__”: secret_name = “RambunctDatabaseSecret” secret = get_secret(secret_name) if secret: print(f”Fetched secret: {secret}”) else: print(“Failed to fetch secret”)

2. Create ConfigMap

Store the script in a Kubernetes ConfigMap:

kubectl create configmap app-script –from-file=app.py

3. Create Deployment

Save the following YAML as deployment.yaml:

apiVersion: apps/v1 kind: Deployment metadata: name: my-app labels: app: my-app spec: replicas: 1 selector: matchLabels: app: my-app template: metadata: labels: app: my-app spec: serviceAccountName: my-app-sa containers: – name: python-app image: python:3.9-slim command: [“/bin/sh”, “-c”] args: – > pip install boto3 && python /app/app.py; volumeMounts: – name: app-script mountPath: /app env: – name: AWS_REGION value: us-east-1 volumes: – name: app-script configMap: name: app-script

4. Apply the deployment:

kubectl apply -f deployment.yaml

Step 7: Verify the Application

1. Check the pod:
   kubectl get pods
2. View the logs:
   kubectl logs

The logs should display the secret retrieved from AWS Secrets Manager.

Conclusion

By following this guide, you’ve set up an EKS cluster, securely stored a secret in AWS Secrets Manager, and deployed an application that fetches the secret dynamically using IRSA. This workflow ensures that sensitive information is securely managed and accessed in a Kubernetes environment.

The post Using AWS Secrets Manager with Amazon EKS for Secure Secrets Management appeared first on Rambunct Consulting.

Why Serverless?

Before diving into the implementation details, it’s essential to understand why serverless architectures have gained so much popularity. Serverless computing abstracts away the need to manage servers, allowing developers to focus on code and business logic rather than worrying about infrastructure. AWS offers several services that support a serverless architecture, including API Gateway, Lambda, and Cognito:

• Amazon API Gateway provides a fully managed service to create and expose RESTful APIs.
• AWS Lambda enables you to run code in response to events without provisioning or managing servers.
• Amazon Cognito offers authentication, authorization, and user management for your applications.

Together, these services allow you to build scalable, secure, and cost-effective APIs.

Steps to Build the Serverless API with User Authentication

We’ll break this down into clear steps for building a serverless API with Amazon API Gateway, Lambda, and Cognito.

Step 1: Set Up Amazon Cognito for User Authentication

Amazon Cognito simplifies adding authentication and user management to your application. It allows you to easily create user pools, manage registration, authentication, and multi-factor authentication.

1. Create a Cognito User Pool: Navigate to the Amazon Cognito console. Define your application-specific user pool requirements. Configure the required options, such as sign-up attributes (e.g., email or phone number) and a return URL for redirecting users after successful login.
2. Use the Login Page: Use the View login page option to access Cognito’s hosted UI for user authentication.
3. App Client Configuration: Navigate to the login page and click on the “Edit” option. Go to OAuth 2.0 grant types and select “Implicit grant”. Using the login dashboard, sign up for an account. After successfully logging in, take note of the URL and copy the ID token for future use.

Step 2: Create a Lambda Function for API Logic

Now we will write the core business logic of the API using AWS Lambda.

1. Create a New Lambda Function: Navigate to the Lambda service in the AWS Console and click Create function. Choose Author from scratch and select Node.js or Python (or any other language you prefer). Set up the Lambda function to execute based on your desired API logic (e.g., creating a resource, fetching data, etc.).

Example Lambda Code: Below is a simple example of a Lambda function that responds with a greeting message: exports.handler = async (event) => {
const name = event.queryStringParameters ? event.queryStringParameters.name : ‘World’;
const response = {
statusCode: 200,
body: JSON.stringify({ message: `Hello, ${name}!` }),
};
return response;
};

2. Configure Permissions:

• Make sure the Lambda function has the appropriate permissions to interact with other AWS services (if needed). You can define the permissions using IAM roles.

Step 3: Set Up Amazon API Gateway

Now we will expose the Lambda function via Amazon API Gateway.

1. Create a New API Gateway: In the AWS Management Console, go to API Gateway and choose Create API. Select REST API and provide a name for your API.
2. Configure the Resource: Navigate to the method settings, configure the method type as GET, and link it to the Lambda function created in the previous step.
3. Enable Authorization with Cognito: Select the Authorizer. Create an authorizer using Amazon Cognito. Configure it based on the provided settings to match your requirements. Select the user pool you created earlier. This ensures that only authenticated users can access the API.
4. Edit the Method Request: Navigate back to the method request settings and click on the “Edit” option. Select the authorizer that you previously created from the available options.
5. Deploy the API: Once everything is set up, deploy the API by creating a new stage (e.g., dev). The API will now be live, and you can call it using the provided endpoint.

Step 4: Test the API

1. Test Without Authentication: Try accessing your API without a token. You should get an unauthorized response.
2. Test With Authentication: Authenticate using the ID token that you noted earlier. To test the API using Postman, follow these steps: Open Postman and create a new request. In the Headers section, add the following: Key: Authorization Value: (Paste the ID token here) Send the request, and you should receive the expected response if the authentication is successful. At this point, you should receive the expected response from the API, confirming successful authentication.

Conclusion

You’ve now built a serverless API using Amazon API Gateway, AWS Lambda, and Amazon Cognito for user authentication. This stack allows you to build secure, scalable, and cost-effective APIs without worrying about server management. By leveraging AWS’s managed services, you can focus on your application’s core logic and let AWS handle the heavy lifting of authentication, authorization, and scaling.

This approach provides:

• Scalability: Automatically scales to handle large amounts of traffic.
• Cost-efficiency: Pay only for what you use, with no infrastructure overhead.
• Security: Easy integration of secure authentication with Amazon Cognito.

The post Building a Serverless API with Amazon API Gateway, AWS Lambda, and Amazon Cognito for User Authentication appeared first on Rambunct Consulting.