Grant an EKS pod IAM access to S3

WHAT THIS TESTS The interviewer wants to know if you can grant least-privilege AWS access to a single pod without distributing static credentials anywhere in the image, manifest, or environment. It probes your understanding of OIDC federation, the pod identity webhook, and short-lived STS tokens.

A GOOD ANSWER COVERS The modern answer is IAM Roles for Service Accounts, IRSA. EKS publishes an OIDC discovery endpoint that AWS IAM trusts as an identity provider. You create an IAM role whose trust policy allows that provider, scoped by a condition matching one namespace and service account. You annotate the Kubernetes service account with the role ARN. A mutating admission webhook injects a projected service-account token and environment variables into the pod. The AWS SDK then calls STS AssumeRoleWithWebIdentity, exchanging that token for temporary credentials scoped to the bucket. The credentials rotate automatically and never appear in manifests or images.

COMMON WRONG ANSWERS Baking access keys into the container image or a Kubernetes Secret. Relying on the node EC2 instance profile so every pod on that node inherits identical permissions, which breaks per-workload least privilege. Using the older kube2iam or kiam proxies that IRSA supersedes. Granting broad S3FullAccess instead of a bucket-scoped policy.

LIKELY FOLLOW-UPS How do you scope the trust policy to a single service account? How does this compare to the newer EKS Pod Identity agent? What is the token lifetime and how does rotation work? How would you audit which pod assumed which role through CloudTrail?

ONE CONCRETE EXAMPLE A payments pod in namespace billing uses service account s3-reader annotated with role arn:aws:iam::123:role/billing-s3. The role trust policy conditions on the OIDC subject equal to system:serviceaccount:billing:s3-reader. At startup the SDK reads the injected token, calls AssumeRoleWithWebIdentity, and receives credentials that can only GetObject from the invoices bucket and expire within an hour, so no static key ever exists.