Reference

ClientIntents example (YAML)

apiVersion: k8s.otterize.com/v1alpha3
kind: ClientIntents
metadata:
  name: server
spec:
  service:
    # The name of the pod that will be granted access
    name: server
  calls:
      # The AWS ARN or ARN wildcard that references the resource(s) for the authorization
    - name: arn:aws:s3:::example-bucket-*/*
      type: aws
      # one or more AWS Actions or Action wildcards that will be provided to the specified resources
      awsActions:
        - "s3:PutObject"
        - "s3:GetObject"
    # Multiple call definitions can be defined for a single service.
    - name: arn:aws:s3:::read-only-bucket-*/*
      type: aws
      awsActions:
        - "s3:GetObject"

Otterize supports templating AWS resource names by AWS region & account ID. The templates $(AWS_REGION) & $(AWS_ACCOUNT_ID) in AWS resource ARNs will be automatically replaced with the EKS cluster's region & account ID:

apiVersion: k8s.otterize.com/v1alpha3
kind: ClientIntents
metadata:
  name: server
spec:
  service:
    name: server
  calls:
    # $(AWS_REGION) & $(AWS_ACCOUNT_ID) will be replaced with the EKS cluster's region & account ID
    - name: arn:aws:sqs:$(AWS_REGION):$(AWS_ACCOUNT_ID):queue1
      type: aws
      awsActions:
        - "sqs:*"

Annotations

Key	Description	Default
credentials-operator.otterize.com/create-aws-role	When set to true, the credential operator will create an unique AWS Role for the associated pod	false

Helm Chart options

Key	Description	Default
global.aws.enabled	Enable or disable AWS integration	false
global.aws.eksClusterNameOverride	EKS cluster name (overrides auto-detection)	(none)
aws.roleARN	ARN of the AWS role the operator will use to access AWS. By defeault, Otterize will create a unique role for each service an annotate the service with the role's ARN.	(none)

View the Helm chart reference for all other options