Intermediate LevelCloud Computing (AWS/GCP/Azure)
How does IAM Roles for Service Accounts (IRSA) grant granular AWS permissions to Kubernetes Pods?
❓ Interview Prompt: Explain Amazon EKS IRSA, OpenID Connect (OIDC) identity provider federation, Service Accounts, and Pod IAM isolation.
Assigning broad IAM roles to EC2 worker nodes means any container running on that node gains full access to those AWS permissions. IAM Roles for Service Accounts (IRSA) implements pod-level least privilege.
IRSA Architecture:
1
EKS OIDC Provider: EKS acts as an OpenID Connect (OIDC) Identity Provider.
2
Service Account Annotation: Kubernetes Service Accounts are annotated with an IAM Role ARN ('eks.amazonaws.com/role-arn').
3
AWS STS JWT Web Identity: When a Pod starts, the EKS Pod Identity Webhook injects a projected OIDC JWT token into the pod container.
4
AssumeRoleWithWebIdentity: AWS SDKs read the JWT and call STS to obtain temporary credentials scoped strictly to that individual Pod!
Code Implementation Example
yaml
# Kubernetes Service Account annotated with IRSA IAM Role
apiVersion: v1
kind: ServiceAccount
metadata:
name: s3-reader-sa
namespace: default
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/EksS3ReaderRole💡Kubernetes Service Account annotated with IRSA IAM Role ARN.
🎯 Interview Key Takeaway
IRSA uses OIDC federation to grant granular AWS IAM permissions directly to individual Kubernetes Pods.
#EKS#IRSA#Kubernetes#IAM#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→