Draft docs

Sample

Purpose

Decision and troubleshooting notes for pod-level AWS permissions in Amazon EKS.

Choose One Pattern

• EKS Pod Identity: simpler operational model for supported EKS clusters and Linux EC2 worker nodes.
• IRSA: useful for OIDC-based compatibility and established workflows.

EKS Pod Identity Trust Policy

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "pods.eks.amazonaws.com" },
    "Action": ["sts:AssumeRole", "sts:TagSession"]
  }]
}

Troubleshooting Checklist

• [ ] Pod uses the intended serviceAccountName.
• [ ] Association exists for the namespace/service account.
• [ ] AWS SDK inside the container is recent enough for the selected identity method.
• [ ] No static AWS_ACCESS_KEY_ID or profile setting is overriding the provider chain.
• [ ] Validate with aws sts get-caller-identity from inside the pod.

Cross-links

• Cluster operations: Amazon EKS Operations
• Command snippets: Kubernetes and AWS CLI snippets

Verified References

EKS Pod Identity