ansible-devops
ansible-devops copied to clipboard
Make ClusterIssuer use AWS Role instead of AWS User
HI I understand we are currently using AWS User that has Route53 permissions to be used with clusterissuer to deploy lets-encrypt (acme TLS) certs. From an AWS security perspective, staying away from AWS user but moving towards AWS Role is ideal.
I understand switching to a role may require tweaking at the IBM Cert Manager Operator to work correctly. Wondering if you can consider this as a feature request and implement this so it follows the Security requirements.
https://github.com/ibm-mas/ansible-devops/blob/6ece690080033adeac19d9ee42ed8b83154cc157/ibm/mas_devops/roles/suite_dns/templates/route53/clusterissuer.yml.j2#L25C35-L25C35
References: https://cert-manager.io/docs/configuration/acme/dns01/route53/