// Module included in the following assemblies:
//
// * authentication/assuming-an-aws-iam-role-for-a-service-account.adoc

:_mod-docs-content-type: PROCEDURE
[id="deploying-a-pod-that-includes-an-aws-sdk_{context}"]
= Deploy a pod that includes an AWS SDK

[role="_abstract"]
To enable your application to automatically assume an AWS Identity and Access Management (IAM) role within a pod, you can assign a previously created service account to the pod so that it can automatically detect which IAM role to assume.

In your pod configuration, specify the service account that includes the `eks.amazonaws.com/role-arn` annotation. With the service account reference in place for your pod, the pod identity webhook injects the AWS environment variables, the volume mount, and the token volume into your pod. The pod mutation enables the service account to automatically assume the AWS IAM role in the pod.

.Prerequisites

* You have created an AWS IAM role for your service account. For more information, see _Setting up an AWS IAM role for a service account_.
* You have access to a {product-title} cluster that uses the AWS Security Token Service (STS). Admin-level user privileges are not required.
* You have installed the {oc-first}.
* You have created a service account in your project that includes an `eks.amazonaws.com/role-arn` annotation that references the Amazon Resource Name (ARN) for the IAM role that you want the service account to assume.
* You have a container image that includes an AWS SDK and the image is available to your cluster. For detailed steps, see _Creating an example AWS SDK container image_.
+
[NOTE]
====
In this example procedure, the AWS Boto3 SDK for Python is used. For more information about installing and using the AWS Boto3 SDK, see the link:https://boto3.amazonaws.com/v1/documentation/api/latest/index.html[AWS Boto3 documentation]. For details about other AWS SDKs, see link:https://docs.aws.amazon.com/sdkref/latest/guide/overview.html[AWS SDKs and Tools Reference Guide] in the AWS documentation.
====

.Procedure

. Create a file named `awsboto3sdk-pod.yaml` with the following pod configuration. In this example pod configuration, the `sleep 100000` line keeps the pod running for 100000 seconds to enable verification testing in the pod directly. For detailed verification steps, see _Verifying the assumed IAM role in your pod_.
+
[source,yaml]
----
apiVersion: v1
kind: Pod
metadata:
  namespace: <project_name>
  name: awsboto3sdk
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  serviceAccountName: <service_account_name>
  containers:
  - name: awsboto3sdk
    image: quay.io/<quay_username>/awsboto3sdk:latest
    command:
    - /bin/bash
    - "-c"
    - "sleep 100000"
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]
  terminationGracePeriodSeconds: 0
  restartPolicy: Never
----
where::
`<project_name>`:: Replace `<project_name>` with the name of your project. The name must match the project name that you specified in your AWS IAM role configuration.
`<service_account_name>`:: Replace `<service_account_name>` with the name of the service account that is configured to assume the AWS IAM role. The name must match the service account name that you specified in your AWS IAM role configuration.
`<quay_username>`:: Replace `<quay_username>` with your Quay.io username to specify the location of your `awsboto3sdk` container image.

. Deploy an `awsboto3sdk` pod:
+
[source,terminal]
----
$ oc create -f awsboto3sdk-pod.yaml
----
+
The output is similar to the following example:
+
[source,terminal]
----
pod/awsboto3sdk created
----
