Infrastructure(AWS) Option¶

This section describes the integration with AWS managed services and fine-tuning.

Observability¶

It is possible to integrate with various AWS observability-related services. Please refer to the following AWS documentation for details.

Setting IAM roles for Pods¶

In AWS EKS, it is possible to achieve fine-grained access control on a per-Pod basis by associating Kubernetes service accounts with IAM roles.
For example, it is possible to associate an IAM role ARN with the service account's annotation as follows:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/your-role

---
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: my-sa
  ...

Create a service account as necessary.
- Please refer to IAM roles for service accounts for details.
Also, to obtain the IAM role token from the service account, an IAM OIDC provider must be prepared for each cluster.
- Please refer to Create an IAM OIDC provider for your cluster for details.

Setting up authentication flow via AWS Cognito¶

It is possible to select the Cognito type in the RISKEN ALB authentication settings.
By using the Cognito user pool, it is also possible to allow logins from multiple IdPs.
Please refer to Using Amazon Cognito for details.

Setting up a custom domain URL¶

It is possible to set up a custom domain using Route53 Alias Records

Integrating with RDS¶

Using RDS improves availability, maintainability, and observability.
Particularly in a production environment, it is recommended to use RDS.
To connect to RDS, you need to set the connection information for the DB in RISKEN parameters.

Environment Variable	Description
DB_MASTER_HOST	Hostname of the master DB
DB_MASTER_USER	Username of the master DB
DB_MASTER_PASSWORD	Password of the master DB
DB_SLAVE_HOST	Hostname of the slave DB (ReadOnly)
DB_SLAVE_USER	Username of the slave DB (ReadOnly)
DB_SLAVE_PASSWORD	Password of the slave DB (ReadOnly)

Integrating with SQS¶

Using SQS improves availability, maintainability, and observability.
Particularly in a production environment, it is recommended to use SQS.

Registering system properties in Parameter Store¶

RISKEN supports fetching environment variable values to be set for each Pod from Parameter Store. Refer to the Parameters page for details.

Managing credentials with Secrets Manager¶

WIP

Creating an endpoint for access tokens¶

To enable programmable API access using RISKEN's access token feature, you need to prepare an endpoint for access tokens.
The following is an example of creating an endpoint by adding a listener rule to the same ALB.
Prepare a subdomain for access tokens.
- Example: api.your-domain.com

Add a listener rule for the ALB for access tokens.

# For console access (accessed from a web browser)
IF:
    - Host Header: console.your-domain.com
    - Path: /api/*
THEN:
    - Authenticatate: OIDC(*)
    - ForwardTo: {Target Group for API}

# For access tokens (accessed from curl or similar)
IF:
    - Host Header: api.your-domain.com
    - Path: /api/*
    - Source IP: {Configure if necessary}
THEN:
    - ForwardTo: {Target Group for API}

Warning

The lack of authentication settings in the rule for access tokens makes it less secure, but you need to log in to the console for the initial token issuance operation. Also, the token can have an expiration date set.