Secure access to Kubernetes deployment endpoints on Amazon EKS

aws-iam-route53-policy.json

{
  "Version": "2012–10–17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "route53:GetChange",
      "Resource": "arn:aws:route53:::change/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "route53:ChangeResourceRecordSets",
        "route53:ListResourceRecordSets"
      ],
      "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
    }
  ]
}

letsencrypt-issuer-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: letsencrypt-issuer-secret
  namespace: cert-manager
data:
  YOUR_AWS_USER: YOUR_BASE64_ENCODED_SECRET_ACCESS_KEY

letsencrypt-issuer.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-issuer
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: you@yourdomain.com
    privateKeySecretRef:
      name: letsencrypt-issuer
    solvers:
    - selector:
        dnsZones:
          - "yourdomain.com"
      dns01:
        route53:
          region: YOUR_AWS_REGION
          hostedZoneID: YOUR_HOSTED_ZONE_ID
          accessKeyID: YOUR_AWS_ACCESS_KEY_ID
          secretAccessKeySecretRef:
            name: letsencrypt-issuer-secret
            key: YOUR_AWS_USER

my-ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-issuer"

spec:
  tls:
  - hosts:
    - yourhost.yourdomain.com
    secretName: my-ingress-tls

  rules:
  - host: yourhost.yourdomain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: YOUR_ENDPOINT_SERVICE_NAME
          servicePort: YOUR_ENDPOINT_SERVICE_PORT