@@ -33,7 +33,7 @@ namespace Amazon.EKS.Model
3333 /// Container for the parameters to the CreatePodIdentityAssociation operation.
3434 /// Creates an EKS Pod Identity association between a service account in an Amazon EKS
3535 /// cluster and an IAM role with <i>EKS Pod Identity</i>. Use EKS Pod Identity to give
36- /// temporary IAM credentials to pods and the credentials are rotated automatically.
36+ /// temporary IAM credentials to Pods and the credentials are rotated automatically.
3737 ///
3838 ///
3939 /// <para>
@@ -43,26 +43,46 @@ namespace Amazon.EKS.Model
4343 /// </para>
4444 ///
4545 /// <para>
46- /// If a pod uses a service account that has an association, Amazon EKS sets environment
47- /// variables in the containers of the pod . The environment variables configure the Amazon
46+ /// If a Pod uses a service account that has an association, Amazon EKS sets environment
47+ /// variables in the containers of the Pod . The environment variables configure the Amazon
4848 /// Web Services SDKs, including the Command Line Interface, to use the EKS Pod Identity
4949 /// credentials.
5050 /// </para>
5151 ///
5252 /// <para>
53- /// Pod Identity is a simpler method than <i>IAM roles for service accounts</i>, as this
54- /// method doesn't use OIDC identity providers. Additionally, you can configure a role
55- /// for Pod Identity once, and reuse it across clusters.
53+ /// EKS Pod Identity is a simpler method than <i>IAM roles for service accounts</i>, as
54+ /// this method doesn't use OIDC identity providers. Additionally, you can configure a
55+ /// role for EKS Pod Identity once, and reuse it across clusters.
56+ /// </para>
57+ ///
58+ /// <para>
59+ /// Similar to Amazon Web Services IAM behavior, EKS Pod Identity associations are eventually
60+ /// consistent, and may take several seconds to be effective after the initial API call
61+ /// returns successfully. You must design your applications to account for these potential
62+ /// delays. We recommend that you don’t include association create/updates in the critical,
63+ /// high-availability code paths of your application. Instead, make changes in a separate
64+ /// initialization or setup routine that you run less frequently.
65+ /// </para>
66+ ///
67+ /// <para>
68+ /// You can set a <i>target IAM role</i> in the same or a different account for advanced
69+ /// scenarios. With a target role, EKS Pod Identity automatically performs two role assumptions
70+ /// in sequence: first assuming the role in the association that is in this account, then
71+ /// using those credentials to assume the target IAM role. This process provides your
72+ /// Pod with temporary credentials that have the permissions defined in the target role,
73+ /// allowing secure access to resources in another Amazon Web Services account.
5674 /// </para>
5775 /// </summary>
5876 public partial class CreatePodIdentityAssociationRequest : AmazonEKSRequest
5977 {
6078 private string _clientRequestToken ;
6179 private string _clusterName ;
80+ private bool ? _disableSessionTags ;
6281 private string _awsNamespace ;
6382 private string _roleArn ;
6483 private string _serviceAccount ;
6584 private Dictionary < string , string > _tags = AWSConfigs . InitializeCollections ? new Dictionary < string , string > ( ) : null ;
85+ private string _targetRoleArn ;
6686
6787 /// <summary>
6888 /// Gets and sets the property ClientRequestToken.
@@ -86,7 +106,7 @@ internal bool IsSetClientRequestToken()
86106 /// <summary>
87107 /// Gets and sets the property ClusterName.
88108 /// <para>
89- /// The name of the cluster to create the association in.
109+ /// The name of the cluster to create the EKS Pod Identity association in.
90110 /// </para>
91111 /// </summary>
92112 [ AWSProperty ( Required = true ) ]
@@ -102,12 +122,46 @@ internal bool IsSetClusterName()
102122 return this . _clusterName != null ;
103123 }
104124
125+ /// <summary>
126+ /// Gets and sets the property DisableSessionTags.
127+ /// <para>
128+ /// Disable the automatic sessions tags that are appended by EKS Pod Identity.
129+ /// </para>
130+ ///
131+ /// <para>
132+ /// EKS Pod Identity adds a pre-defined set of session tags when it assumes the role.
133+ /// You can use these tags to author a single role that can work across resources by allowing
134+ /// access to Amazon Web Services resources based on matching tags. By default, EKS Pod
135+ /// Identity attaches six tags, including tags for cluster name, namespace, and service
136+ /// account name. For the list of tags added by EKS Pod Identity, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags">List
137+ /// of session tags added by EKS Pod Identity</a> in the <i>Amazon EKS User Guide</i>.
138+ /// </para>
139+ ///
140+ /// <para>
141+ /// Amazon Web Services compresses inline session policies, managed policy ARNs, and session
142+ /// tags into a packed binary format that has a separate limit. If you receive a <c>PackedPolicyTooLarge</c>
143+ /// error indicating the packed binary format has exceeded the size limit, you can attempt
144+ /// to reduce the size by disabling the session tags added by EKS Pod Identity.
145+ /// </para>
146+ /// </summary>
147+ public bool DisableSessionTags
148+ {
149+ get { return this . _disableSessionTags . GetValueOrDefault ( ) ; }
150+ set { this . _disableSessionTags = value ; }
151+ }
152+
153+ // Check to see if DisableSessionTags property is set
154+ internal bool IsSetDisableSessionTags ( )
155+ {
156+ return this . _disableSessionTags . HasValue ;
157+ }
158+
105159 /// <summary>
106160 /// Gets and sets the property Namespace.
107161 /// <para>
108- /// The name of the Kubernetes namespace inside the cluster to create the association
109- /// in. The service account and the pods that use the service account must be in this
110- /// namespace.
162+ /// The name of the Kubernetes namespace inside the cluster to create the EKS Pod Identity
163+ /// association in. The service account and the Pods that use the service account must
164+ /// be in this namespace.
111165 /// </para>
112166 /// </summary>
113167 [ AWSProperty ( Required = true ) ]
@@ -128,7 +182,7 @@ internal bool IsSetNamespace()
128182 /// <para>
129183 /// The Amazon Resource Name (ARN) of the IAM role to associate with the service account.
130184 /// The EKS Pod Identity agent manages credentials to assume this role for applications
131- /// in the containers in the pods that use this service account.
185+ /// in the containers in the Pods that use this service account.
132186 /// </para>
133187 /// </summary>
134188 [ AWSProperty ( Required = true ) ]
@@ -225,5 +279,39 @@ internal bool IsSetTags()
225279 return this . _tags != null && ( this . _tags . Count > 0 || ! AWSConfigs . InitializeCollections ) ;
226280 }
227281
282+ /// <summary>
283+ /// Gets and sets the property TargetRoleArn.
284+ /// <para>
285+ /// The Amazon Resource Name (ARN) of the target IAM role to associate with the service
286+ /// account. This role is assumed by using the EKS Pod Identity association role, then
287+ /// the credentials for this role are injected into the Pod.
288+ /// </para>
289+ ///
290+ /// <para>
291+ /// When you run applications on Amazon EKS, your application might need to access Amazon
292+ /// Web Services resources from a different role that exists in the same or different
293+ /// Amazon Web Services account. For example, your application running in “Account A”
294+ /// might need to access resources, such as Amazon S3 buckets in “Account B” or within
295+ /// “Account A” itself. You can create a association to access Amazon Web Services resources
296+ /// in “Account B” by creating two IAM roles: a role in “Account A” and a role in “Account
297+ /// B” (which can be the same or different account), each with the necessary trust and
298+ /// permission policies. After you provide these roles in the <i>IAM role</i> and <i>Target
299+ /// IAM role</i> fields, EKS will perform role chaining to ensure your application gets
300+ /// the required permissions. This means Role A will assume Role B, allowing your Pods
301+ /// to securely access resources like S3 buckets in the target account.
302+ /// </para>
303+ /// </summary>
304+ public string TargetRoleArn
305+ {
306+ get { return this . _targetRoleArn ; }
307+ set { this . _targetRoleArn = value ; }
308+ }
309+
310+ // Check to see if TargetRoleArn property is set
311+ internal bool IsSetTargetRoleArn ( )
312+ {
313+ return this . _targetRoleArn != null ;
314+ }
315+
228316 }
229317}
0 commit comments