IRSA — IAM Roles for Service Accounts

IRSA lets a pod assume an IAM role through its Kubernetes service account — no node-wide credentials.

IRSA (IAM Roles for Service Accounts) is how you give a specific pod least-privilege access to AWS APIs. Instead of attaching broad permissions to the node, you bind an IAM role to a Kubernetes service account.

IRSA flow from pod to service account to IAM role via OIDCPodusesServiceAccountprojected tokenOIDC ProviderSTS trustIAM Rolescoped policyThe pod's projected token is exchanged via the OIDC provider for temporary IAM credentials.
The pod presents its service account token; AWS STS trusts the cluster's OIDC provider and returns temporary credentials for the mapped IAM role.

Why IRSA is better than node roles

  • Each workload gets only the permissions it needs — true least privilege.
  • Credentials are short-lived and automatically rotated.
  • No secrets are stored in the pod.

Example

Example · bash
# Create a service account bound to an IAM policy via IRSA
eksctl create iamserviceaccount \
  --cluster demo \
  --namespace default \
  --name s3-reader \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
  --approve

When to use it

  • An application team lets their S3-reading pods assume a minimal IAM role via IRSA, removing the need for access keys injected as Kubernetes secrets.
  • A platform team uses IRSA so the Cluster Autoscaler can describe and modify Auto Scaling groups without granting those permissions to all pods on the node.
  • A security auditor verifies that a pod's IAM role is scoped to a single S3 bucket prefix, confirming IRSA's least-privilege enforcement.

More examples

Create IRSA service account

Creates an IAM role, a Kubernetes service account, and wires them together via the OIDC provider so pods using this SA get AWS credentials.

Example · bash
eksctl create iamserviceaccount \
  --name s3-reader \
  --namespace default \
  --cluster prod \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
  --approve
kubectl get serviceaccount s3-reader -o yaml

Pod using IRSA service account

A pod that references the IRSA service account; the VPC CNI injects AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE as environment variables automatically.

Example · yaml
apiVersion: v1
kind: Pod
metadata:
  name: s3-reader-pod
spec:
  serviceAccountName: s3-reader
  containers:
  - name: app
    image: amazon/aws-cli:latest
    command: ["aws", "s3", "ls", "s3://my-bucket/"]

Check IRSA annotation on SA

Verifies the IRSA role ARN annotation on the service account, confirming the IAM-to-SA binding is correctly configured.

Example · bash
kubectl get serviceaccount s3-reader \
  -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}'
# Output: arn:aws:iam::123456789012:role/prod-s3-reader

Related

eks oidc providereks rbac

Discussion

  • Be the first to comment on this lesson.