Fixed AK/SK
    Save to a Secret or an external configuration system.
    Inject into the Pod.
    The SDK reads the AK/SK.
    Access TencentCloud APIs directly.

The ServiceAccount used by the Pod
    TKE issues a short-lived OIDC Token.
    STS validates the Token and the role trust relationship.
    Return temporary credentials for the CAM role.
    The SDK accesses TencentCloud APIs.

{
  "iss": "<OIDC Issuer URL of the TKE cluster>",
  "sub": "system:serviceaccount:prod:cos-reader",
  "aud": ["sts.cloud.tencent.com"],
  "iat": 1720000000,
  "exp": 1720003600
}

TKE OIDC Provider
  + aud = sts.cloud.tencent.com
  + sub = system:serviceaccount:prod:cos-reader
                         └──> CAM role cos-reader-role
                                  └──> Read-only access to the specified COS Bucket

{
  "version": "2.0",
  "statement": [{
    "effect": "allow",
    "principal": {
      "federated": ["qcs::cam::uin/xxx:oidcProvider/tke-<cluster-id>"]
    },
    "action": ["sts:AssumeRoleWithWebIdentity"],
    "condition": {
      "string_equal": {
        "oidc:aud": ["sts.cloud.tencent.com"],
        "oidc:sub": ["system:serviceaccount:prod:cos-reader"]
      }
    }
  }]
}

{
  "version": "2.0",
  "statement": [{
    "effect": "allow",
    "action": ["cos:GetObject", "cos:HeadObject", "cos:ListBucket"],
    "resource": ["qcs::cos:ap-guangzhou:uid/xxx:my-bucket-xxx/*"]
  }]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cos-reader
  namespace: prod
  annotations:
    tke.cloud.tencent.com/role-arn: qcs::cam::uin/xxx:roleName/cos-reader-role
    tke.cloud.tencent.com/audience: sts.cloud.tencent.com
    tke.cloud.tencent.com/token-expiration: "3600"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: prod
spec:
  template:
    spec:
      serviceAccountName: cos-reader
      containers:
        - name: app
          image: my-app:latest

Explicitly pass in the SecretId/Key.
    Environment variables TENCENTCLOUD_SECRET_ID/KEY
    OIDC Web Identity Token (Pod OIDC scenario)
    CVM instance role (node role)
    Throw an error.

provider, err := common.DefaultTkeOIDCRoleArnProvider()
if err != nil { /* ... */ }

cred, err := provider.GetCredential()
if err != nil { /* ... */ }

client, _ := cos.NewClient(&cos.BaseURL{...}, &http.Client{
    Transport: &cos.AuthorizationTransport{
        SecretID:     cred.GetSecretId(),
        SecretKey:    cred.GetSecretKey(),
        SessionToken: cred.GetToken(),
    },
})

rules:
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["patch", "update"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: ["get"]

TKE ServiceAccount
    └──> TKE OIDC Token
            └──> AWS STS AssumeRoleWithWebIdentity
                    └──> Temporary credentials for the AWS IAM Role
                            └──> S3 / DynamoDB / SQS / Other AWS services

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::example-bucket"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::example-bucket/*"]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/<ISSUER_HOST_AND_PATH>"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<ISSUER_HOST_AND_PATH>:aud": "sts.amazonaws.com",
          "<ISSUER_HOST_AND_PATH>:sub": "system:serviceaccount:prod:s3-reader"
        }
      }
    }
  ]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: s3-reader
  namespace: prod
  annotations:
    tke.cloud.tencent.com/role-arn: arn:aws:iam::<AWS_ACCOUNT_ID>:role/tke-s3-reader
    tke.cloud.tencent.com/audience: sts.amazonaws.com
    tke.cloud.tencent.com/token-expiration: "3600"

TKE_ROLE_ARN=arn:aws:iam::<AWS_ACCOUNT_ID>:role/tke-s3-reader
TKE_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/cloud.tencent.com/serviceaccount/token

package awsauth

import (
    "context"
    "fmt"
    "os"

    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/credentials/stscreds"
    "github.com/aws/aws-sdk-go-v2/service/s3"
    "github.com/aws/aws-sdk-go-v2/service/sts"
)

func NewS3Client(ctx context.Context, awsRegion string) (*s3.Client, error) {
    roleARN := os.Getenv("TKE_ROLE_ARN")
    tokenFile := os.Getenv("TKE_WEB_IDENTITY_TOKEN_FILE")
    if roleARN == "" || tokenFile == "" {
        return nil, fmt.Errorf("missing TKE_ROLE_ARN or TKE_WEB_IDENTITY_TOKEN_FILE")
    }

    baseCfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(awsRegion))
    if err != nil {
        return nil, fmt.Errorf("load AWS base config: %w", err)
    }

    stsClient := sts.NewFromConfig(baseCfg)
    roleSessionName := os.Getenv("HOSTNAME")
    if roleSessionName == "" {
        roleSessionName = "tke-pod"
    }

    provider := stscreds.NewWebIdentityRoleProvider(
        stsClient,
        roleARN,
        stscreds.IdentityTokenFile(tokenFile),
        func(options *stscreds.WebIdentityRoleOptions) {
            options.RoleSessionName = roleSessionName
        },
    )

    cfg, err := config.LoadDefaultConfig(
        ctx,
        config.WithRegion(awsRegion),
        config.WithCredentialsProvider(provider),
    )
    if err != nil {
        return nil, fmt.Errorf("load AWS config with web identity: %w", err)
    }

    return s3.NewFromConfig(cfg), nil
}