Support IAM Roles for Service Accounts in EKS

README.md

@@ -126,6 +126,20 @@ You'll need to ensure that the environment in which the fluentd plugin runs has
 }
 ```
 
+### EKS
+If you want to use IAM roles for service accounts on Amazon EKS clusters, please refer to the official documentation and specify a Service Account for your fluentd Pod.
+
+Then, the endpoint configuration looks like:
+
+```ruby
+<endpoint>
+  url https://CLUSTER_ENDPOINT_URL
+  region eu-west-1
+  assume_role_arn "#{ENV['AWS_ROLE_ARN']}"
+  assume_role_web_identity_token_file "#{ENV['AWS_WEB_IDENTITY_TOKEN_FILE']}"
+</endpoint>
+```
+
 ## Troubleshooting
 
 * "Elasticsearch::Transport::Transport::Errors::Forbidden" error="[403]" even after verifying the access keys/roles/policies.

lib/fluent/plugin/out_aws-elasticsearch-service.rb

@@ -19,6 +19,7 @@ class AwsElasticsearchServiceOutput < ElasticsearchOutput
       config_param :assume_role_arn, :string, :default => nil
       config_param :ecs_container_credentials_relative_uri, :string, :default => nil #Set with AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable value
       config_param :assume_role_session_name, :string, :default => "fluentd"
+      config_param :assume_role_web_identity_token_file, :string, :default => nil
     end
 
     # here overrides default value of reload_connections to false because
@@ -84,11 +85,19 @@ def credentials(opts)
               }).credentials
             end
           else
-            credentials = sts_credential_provider({
-                            role_arn: opts[:assume_role_arn],
-                            role_session_name: opts[:assume_role_session_name],
-                            region: opts[:region]
-                          }).credentials
+            if opts[:assume_role_web_identity_token_file].nil?
+              credentials = sts_credential_provider({
+                              role_arn: opts[:assume_role_arn],
+                              role_session_name: opts[:assume_role_session_name],
+                              region: opts[:region]
+                            }).credentials
+            else
+              credentials = sts_web_identity_credential_provider({
+                              role_arn: opts[:assume_role_arn],
+                              web_identity_token_file: opts[:assume_role_web_identity_token_file],
+                              region: opts[:region]
+                            }).credentials
+            end
           end
         end
         raise "No valid AWS credentials found." unless credentials.set?
@@ -106,6 +115,11 @@ def sts_credential_provider(opts)
       @sts ||= Aws::AssumeRoleCredentials.new(opts)
     end
 
+    def sts_web_identity_credential_provider(opts)
+      # AssumeRoleWebIdentityCredentials is an auto-refreshing credential provider
+      @sts ||= Aws::AssumeRoleWebIdentityCredentials.new(opts)
+    end
+
   end