Attach a Cloud IAM Role

This guide shows you how to let an application assume an AWS or GCP IAM role, using the iam dependency engine.

Grants your application access to cloud services such as buckets and queues by
binding IAM roles to its Kubernetes service account. The platform creates the
service account mappings for you.

serviceAccount:
  create: true

dependency:
  iam:
    buckets: "true"
    roles:
      - roles/storage.objectViewer
      - roles/pubsub.publisher

To provision a standalone IAM service account with custom policies on AWS, see
IAM Service Accounts
instead.

Related articles

• Application Dependencies — all dependency engines, and how to choose
• Attach to Your Application
• Secrets Manager
• IAM Service Accounts
• Access Management