certmanager v1.21.1

Issuer.spec.vault.auth.aws

AWS authenticates with Vault using AWS IAM authentication. This allows authentication using IAM roles for service accounts (IRSA), EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).

Issuer.spec.vault.auth.aws fields and descriptions
Field / Type	Description
iamRoleArn `string`	The ARN of the AWS IAM role to assume using the Kubernetes service account token. Required when using IRSA (serviceAccountRef is set). This role must have a trust policy that allows the OIDC provider to assume it.
mountPath `string`	The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/aws" will be used.
region `string`	The AWS region to use for authentication. If not specified, the region will be determined from AWS_REGION or AWS_DEFAULT_REGION environment variables, falling back to "us-east-1" if not set.
role `string` required	A required field containing the Vault Role to assume when authenticating. `minLength: 1`
serviceAccountRef `object`	A reference to a service account that will be used to request a web identity token for IRSA (IAM Roles for Service Accounts) authentication.
vaultHeaderValue `string`	The Vault header value to include in the STS signing request. This is used to prevent replay attacks.