ServiceAccount integration for AWS about provider-aws

[negz]

Thanks for raising this issue @phanimullapudi!

https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

It sounds like what you want to do is leverage the above EKS functionality such that Crossplane can use an IAM role associated with a Kubernetes ServiceAccount, instead of using an IAM role whose access token is stored in a Kubernetes Secret?

It's possible we could enable this by:

1. Adding a field to the existing AWS provider that instructs the stack-aws binary to fall back to using web identity tokens per aws/aws-sdk-go#2667.
2. Update all managed resource controllers to respect said field.
3. Documenting how to setup the stack-aws deployment to use service account based IAM roles ala https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-cni-walkthrough.html (and/or automating it in our Helm chart).

[negz]

This is very closely related to #110.

[phanimullapudi]

Our current EKS stack is configured to use IAM roles using OIDC. The mentioned above way looks reasonable for me.

[negz]

Cross linking another related issue: crossplane/crossplane-runtime#101

[hasheddan]

Providing an update here. We currently use aws-sdk-go-v2 across stack-aws and unfortunately this functionality has not been implemented on v2: aws/aws-sdk-go-v2#475

I have successfully deployed stack-aws in an EKS cluster using IAM roles for ServiceAccount, and that is working well, it is just consuming the credentials that is a bit more of a hurdle. I believe we can manually assume the role using the sts client, but I will also investigate if I can provide a simple upstream fix to the issue referenced above.