IRSA Authentication for S3 Backup in IBM API Connect on EKS

Description:

We would like IBM API Connect to support AWS IAM Role-based authentication for S3 backup storage, specifically for deployments running on Amazon EKS.

Current limitation:
Today, API Connect Management subsystem backup to S3 requires static AWS access key and secret key credentials stored in Kubernetes secrets. This creates several challenges in enterprise environments with strict security and compliance requirements.

Problem statement:
Many organizations prohibit the use of long-lived IAM user credentials because they:

• Increase credential management overhead

• Require periodic rotation

• Introduce security risks if secrets are exposed

• Conflict with modern cloud-native security best practices

In AWS EKS environments, the recommended authentication mechanism is IAM Roles for Service Accounts (IRSA), which provides temporary credentials dynamically via AWS STS without storing static secrets.

Requested enhancement:
Please add support for IAM Role-based authentication methods for S3 backup, including:

• IRSA (IAM Roles for Service Accounts) on EKS

Expected behavior:
API Connect backup components should be able to authenticate to S3 using the IAM role attached to the Kubernetes service account or node instance, without requiring access key / secret key configuration.

Benefits:

• Improved security posture

• Elimination of long-lived credentials

• Better compliance with enterprise security policies

• Alignment with AWS cloud-native best practices

• Reduced operational overhead for credential rotation

• Easier integration with enterprise governance models

Use case:
Our organization deploys IBM API Connect on Amazon EKS. Due to enterprise security policies, creation of IAM users and long-lived access keys is prohibited. As a result, we are currently unable to implement a compliant S3 backup solution using the supported configuration model.