IAM and billing

On AWS Marketplace, FineParser Enterprise is billed per worker pod-hour at the listing’s rate. Each worker registers with AWS Marketplace when it starts, and is metered until it stops. The orchestrator and ingest are not billed, so a pool scaled to zero incurs no software charges. Workers kept running by scaling.minWorkers are billed whether or not they have work. Workers register with an IAM role in your account, through IAM roles for service accounts (IRSA). EKS Pod Identity, node roles, and access keys are not supported. A worker that cannot register exits without taking work.

Create the role and service account

The role needs the AWS managed policy AWSMarketplaceMeteringRegisterUsage, and must trust the service account the release runs under.

AWSMarketplaceMeteringFullAccess does not grant RegisterUsage, despite its name. Workers signing with it are refused.

Your own service account
Chart-created service account

eksctl creates the role and an annotated service account together:

eksctl create iamserviceaccount \
  --cluster <cluster> --region <region> \
  --namespace fineparser --name fineparser \
  --role-name FineParserMetering \
  --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage \
  --approve

fineparser-values.yaml

serviceAccount:
  create: false
  name: fineparser

The AWS Marketplace launch instructions may fill in serviceAccount.name. It must name a service account set up this way.

The chart names its service account fineparser-orchestrator for a release named fineparser. Create a role trusted by that name, then annotate the chart’s account with it:

eksctl create iamserviceaccount \
  --cluster <cluster> --region <region> \
  --namespace fineparser --name fineparser-orchestrator \
  --role-name FineParserMetering --role-only \
  --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage \
  --approve

fineparser-values.yaml

serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account>:role/FineParserMetering

If you create the role another way, its trust policy must allow sts:AssumeRoleWithWebIdentity from the cluster’s OIDC provider, with sub set to system:serviceaccount:<namespace>:<service-account> and aud set to sts.amazonaws.com.

Region

Workers register in the region the EKS pod identity webhook injects. Set awsMarketplace.region only if your cluster does not inject AWS_REGION.

Confirming billing works

Once a job has started a worker:

kubectl -n fineparser logs deploy/fineparser-worker | grep billing
# billing: registered with AWS Marketplace, this pod is metered hourly

Anything else names the problem. See Troubleshooting.

Getting Started

Basics

Concepts

Best Practices

AWS

Reference

Create the role and service account

Region

Confirming billing works

​Create the role and service account

​Region

​Confirming billing works

Create the role and service account

Region

Confirming billing works