~/ nmadiraju.com Amazon EKS · Cross-account ALB ingress
arrow_back Back to nmadiraju
Architecture Explorer · Security

Cross-Account ALBs for Amazon EKS, Taken Apart

The public load balancer (ALB) lives in an Edge account; the pods run in another. Click any part to see what breaks without it, then follow one request from a 503 error to a pod.

Cross-account ingress in 60 seconds

  • Cross-account ingress: the public load balancer (ALB) sits in an Edge account, and the pods it serves run in an EKS cluster in another account.
  • Two joins. Identity: a controller borrows an Edge role to list pod IPs in the ALB's target group. Network: the ALB reaches them.
  • No stored keys. EKS Pod Identity gives the controller short-lived credentials. It assumes the Edge role, passing a shared external ID.
  • Registered isn't reachable. Pods can be listed yet unhealthy: the ALB also needs a route to the pod IPs and a security group rule.
  • Let the platform own the ALB. The cluster only fills the target group, so deleting a Kubernetes object can empty it, never delete the ALB.

1Explore both accounts

An Edge account with the ALB and a Compute account with the EKS cluster, joined by STS and the network Left, Dana's browser and the platform team's Terraform pipeline. Next, the Edge account: Route 53, AWS WAF, an ACM certificate, the internet-facing Application Load Balancer, target group checkout-tg and the Edge IAM role. In the middle, the two joins: AWS STS for identity and a network join (VPC peering). Right, the Compute account: the controller's IAM role and EKS cluster prod-cluster with the AWS Load Balancer Controller, a TargetGroupBinding, an unused Ingress, the pods' security group and the checkout pods. Dana · browser checkout.example.com Platform team Terraform pipeline EDGE ACCOUNT 111122223333 Route 53 alias to ALB public DNS AWS WAF web firewall on the ALB ACM public cert TLS ends at ALB Application Load Balancer internet-facing · HTTPS 443 Target group checkout-tg target type ip · port 8080 Edge role (IAM) trusts only the controller's role THE JOINS AWS STS AssumeRole short-lived no stored key Network join VPC peering Edge ⇄ Compute 2-way routes COMPUTE ACCOUNT 444455556666 Controller's role (IAM) handed out by EKS Pod Identity EKS CLUSTER prod-cluster LB Controller kube-system TargetGroupBinding checkout → Edge TG + Edge role to assume Ingress not used by checkout Pod security group Pods checkout · team-checkout Service checkout · reached by pod IP

    2What broke? Check yourself

    Check yourself