Assume IAM Role instead of using IAM Access Key and Secret (Data Gate for watsonx)

The client, Itaú, follows a strict security policy based on the principle of least privilege, which requires all authentication and authorization operations to be carried out through IAM Roles, rather than using IAM Access Key and Secret pairs, which are prohibited and are not compliantly by Itaú's security terms. Each Data Gate instance must assume a single IAM Role that defines the specific resources it can access within the AWS infrastructure.

For instance, one Data Gate instance may assume IAM Role A, which allows it to write data to specific S3 buckets across two different AWS accounts. Another Data Gate instance may assume IAM Role B, granting access to a bucket in a third AWS account. The least privilege principle ensures that each instance only has access to the designated buckets without overlapping permissions between instances and their respective AWS accounts. Each instance assumes only one IAM Role, ensuring isolation and granular control over the resources accessed, tailored to each instance's needs. (example attached)

This approach aligns with the solutions described in the following references:

https://www.redhat.com/en/blog/running-pods-in-openshift-with-aws-iam-roles-for-service-accounts-aka-irsa

https://www.redhat.com/en/blog/fine-grained-iam-roles-for-openshift-applications

image-2.png

Needed By

Quarter

Post comment

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Please enter your email address

RELATED IDEAS

Assume IAM Role instead of using IAM Access Key and Secret (Data Gate for watsonx)