~/ nmadiraju.com Amazon EKS · Pod Identity and IRSA
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How EKS Pod Identity and IRSA Work on Amazon EKS

Follow the orders Pod's call to S3 from the node's role through IRSA to EKS Pod Identity, then check yourself with 8 questions.

1Visual Walkthrough

An EKS Pod's AWS credentials traced through IMDS, IRSA and EKS Pod Identity Left, cluster prod-east: a control plane with a mutating webhook and service account shop/orders, and node-1 with Pods orders and web, IMDS and the Pod Identity Agent. Middle, AWS STS, the EKS Auth API, S3 bucket acme-orders, and cluster prod-west with another orders Pod. Right, IAM: OIDC providers, role orders-s3 with its trust policy, and the node role eks-node. The walkthrough shows the node-role fallback, blocking IMDS, IRSA, its per-cluster trust edits, and EKS Pod Identity associations. EKS CLUSTER prod-east CONTROL PLANE EKS mutating webhook edits new Pods at admission ServiceAccount shop/orders node-1 · EC2 orders Pod · ns shop needs s3://acme-orders only web Pod · ns shop sa default needs no AWS access Instance metadata (IMDS) 169.254.169.254 Pod Identity Agent 169.254.170.23 · hostNetwork DaemonSet, one per node AWS APIs AWS STS AssumeRoleWithWebIdentity EKS Auth API AssumeRoleForPodIdentity S3 bucket acme-orders s3:GetObject EKS CLUSTER prod-west orders Pod · ns shop sa orders IAM · 111122223333 IAM OIDC providers IAM role orders-s3 Allow s3:GetObject on acme-orders/* TRUST POLICY IAM role eks-node

    2Quiz to check understanding

    Check yourself