IAM Roles, IRSA Policies & Security Groups
23 minIntermediate
This creates billable resources. Run it in a dev environment and destroy it when you finish. Set a budget alarm first.
Success criteria
0 of 2
What you are building#
What are IAM Roles & Security Groups?#
- AWS IAM Roles: Identity permissions granting temporary security credentials to AWS services (such as EKS Worker Nodes or EC2 instances) without embedding static credentials.
- IRSA (IAM Roles for Service Accounts): OIDC integration allowing individual Kubernetes pods to assume specific IAM roles.
- Security Groups: Stateful virtual firewalls controlling inbound and outbound traffic at the instance/ENI level.
text
SECURITY GROUP CHAINING TOPOLOGY
[ Internet Traffic ]
|
| HTTP / Port 80
v
+-----------------------------------------------------------------------------------+
| ALB SECURITY GROUP (sg-alb) |
| - Ingress: 0.0.0.0/0 on Port 80 / 443 |
+----------------------------------------+------------------------------------------+
|
| Ingress: ALLOW sg-alb on Port 8000
v
+-----------------------------------------------------------------------------------+
| EKS WORKER NODES SECURITY GROUP (sg-eks-nodes) |
| - Ingress: Allow Port 8000 from sg-alb |
| - Ingress: Allow Port 22 from Jenkins SG (sg-jenkins) |
+----------------------------------------+------------------------------------------+
|
| Ingress: ALLOW sg-eks-nodes on Port 5432
v
+-----------------------------------------------------------------------------------+
| RDS DATABASE SECURITY GROUP (sg-rds) |
| - Ingress: Allow Port 5432 ONLY from sg-eks-nodes |
+-----------------------------------------------------------------------------------+Steps#
Step 1: Deploy IAM & Security Groups#
Terminal
cd 01-Infrastructure-Terraform/Lab02-IAM-Security-Groups
terraform init
terraform apply -auto-approveVerify it worked#
Terminal
terraform outputExpected Terminal Output:
text
alb_security_group_id = "sg-0a1b2c3d4e5f67890"
eks_nodes_security_group_id = "sg-01111111111111111"
rds_security_group_id = "sg-02222222222222222"Clean up#
Run this even if you did not finish. Everything above is destroyable, and an account full of half-built experiments is how a surprise bill starts.
Destructive — This removes real resources. Check which environment you are in first.
Terminal
terraform destroy -auto-approve
aws iam list-roles --query 'Roles[?starts_with(RoleName, `ivolve`)].RoleName'Cost of this lab: Free — IAM roles, policies and security groups cost nothing. Only the resources they are attached to do.