IAM Creds for KafkaConnect

[sai9920]

I want to deploy s3 sink connector from kafkaconnect Cluster, But i dont want to pass the access key and private key instead trying to use IAM role part of service account. But i am unable to achieve it.

Any help on how to pass this IAM Role ?

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnect
metadata:
  annotations:
    eks.amazonaws.com/role-arn: >-
      arn:aws:iam::awsaccount:role/iamname
    strimzi.io/use-connector-resources: 'true'
  labels:
    argocd.argoproj.io/instance: kafkaconnect
  name: qa-kafkaconnect
  namespace: kafka-connect

spec:
  authentication:
  config:
    config.providers: env
    config.providers.env.class: org.apache.kafka.common.config.provider.EnvVarConfigProvider
    config.storage.replication.factor: 1
    config.storage.topic: kafkaconnect-configs
    group.id: cluster
    offset.storage.replication.factor: 1
    offset.storage.topic: kafkaconnect-offsets
    status.storage.replication.factor: 1
    status.storage.topic: kafkaconnect-status
  image: >-
    kafkaconnect-image:baZrIvzrVzgq_SAsHcVG1FJZ6jECFnvP
  replicas: 3
  template:
    pod:
      metadata:
        annotations:
          iam.amazonaws.com/role: >-
            arn:aws:iam::awsaccount:role/iamname
  tls:
    trustedCertificates: []
  version: 3.6.0
  replicas: 3

[sai9920]

@scholzj please help if their is already an example for it

[scholzj]

I pass the AWS credentials through secret when I need to use them. So I do not have any examples for what you are asking. I guess it will also depend on what tooling you use to assign any credentials etc.

[sai9920]

thanks for response, I dont want to use static accesskey and secret key in secret and refer it. So checking around if any other workarounds.

[sai9920]

Update, i am able to setup Service account for the worker nodes now , which provider class i should use to make the connector pick the environmental variables AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN to authenticate and flow the messages to s3?

  topics: testopic
  errors.tolerance: all
  s3.bucket.name: testssbucket
  s3.region: ap-southeast-1
  format.class: io.confluent.connect.s3.format.json.JsonFormat
  topics.dir: root_key
  # s3.aws.access.key.id: 
  # s3.aws.secret.access.key: 
  flush.size: 1
  storage.class: io.confluent.connect.s3.storage.S3Storage
  s3.part.size: 994288000
  schema.compatibility: NONE
  s3.credentials.provider.class: com.amazonaws.auth.InstanceProfileCredentialsProvider
  schemas.enable: true
  key.converter.schemas.enable: false
  value.converter.schemas.enable: false