From 17953061c4fb53a29ffb39a57764290a41ed0ede Mon Sep 17 00:00:00 2001
From: CarlosPet <143050490+CarlosPet@users.noreply.github.com>
Date: Tue, 5 Sep 2023 08:00:12 -0600
Subject: [PATCH] Added AWS documentation in Kubernetes Authentication
 Documentation (#19588)

* Added AWS documentation in Kubernetes Authentication Documentation

I included instructions on how to configure the AWS server side authentication while using the Kubernetes plug-in.

Signed-off-by: Carlos Inocencio <carlos.inocencio@petco.com>

* Update authentication.md

Updated `aws` reference to use in-line code blocks to avoid triggering an error in the code checks

Signed-off-by: Carlos Inocencio <carlos.inocencio@petco.com>

---------

Signed-off-by: Carlos Inocencio <carlos.inocencio@petco.com>
---
 docs/features/kubernetes/authentication.md | 52 ++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md
index ddeabb5db0..f30521189f 100644
--- a/docs/features/kubernetes/authentication.md
+++ b/docs/features/kubernetes/authentication.md
@@ -28,6 +28,53 @@ The providers available as server side are:
 - `localKubectlProxy`
 - `serviceAccount`
 
+### AWS
+
+For AWS, in addition to the "kubernetes" configuration, you will have to set up AWS authentication. The AWS server-side authentication provider uses [AWS Identity and Access Management (IAM)][3] to authenticate to the target Account(s), you can read more about it on the page for the [Integration AWS node][4].
+
+Using the plugin, you can authenticate to several AWS accounts using either [static AWS Access keys][5] or short-lived Access keys generated by [assuming a role][6], for either case you will need to install the [AWS CLI utility][7] and set it up following the steps in the linked documentation.
+
+If you have generated static AWS security credentials, the configuration block for AWS will look like this:
+
+```yaml
+aws:
+  mainAccount:
+  accounts:
+    - accountId: '<account-number>'
+      accessKeyId: ${AWS_ACCESS_KEY_ID}
+      secretAccessKey: ${AWS_SECRET_ACCESS_KEY}
+      region: <region>
+  accountDefaults:
+```
+
+If your environment is set up to assume a role, the configuration would instead look like this:
+
+```yaml
+aws:
+  mainAccount:
+    roleName: <name-of-the-role-to-assume>
+    region: <region>
+  accounts:
+  accountDefaults:
+```
+
+Either of these sections needs to be present for the Kubernetes configuration to use the `aws` `authProvider`. The Kubernetes configuration looks like this:
+
+```yaml
+kubernetes:
+  serviceLocatorMethod:
+    type: 'multiTenant'
+  clusterLocatorMethods:
+    - type: 'config'
+      clusters:
+        - url: https://<unique-identifier>.<region>.eks.amazonaws.com
+          name: <cluster-name-to-use>
+          authProvider: 'aws'
+          caData: ${EKS_CA_DATA}
+```
+
+You get both, the cluster `url` and `caData` directly from the AWS console by going to `EKS` > `Your cluster` > `Overview` > `Details`. You will find them under 'API server endpoint' and 'Certificate authority' respectively.
+
 ### Azure
 
 The Azure server side authentication provider works by authenticating on the server with
@@ -72,3 +119,8 @@ The providers available as client side are:
 
 [1]: https://docs.microsoft.com/en-us/azure/aks/managed-aad
 [2]: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest
+[3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/when-to-use-iam.html
+[4]: https://github.com/backstage/backstage/blob/master/packages/integration-aws-node/README.md
+[5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
+[6]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html
+[7]: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html