aws-eks-irsa-ksa-maps-to-iam-role
A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn maps to that IAM role; the mapping is realized when the role trust allows the cluster OIDC issuer + sub for this SA.
match (record)
{
"field": "annotations.eks.amazonaws.com/role-arn",
"resource_type": "k8s:ServiceAccount"
}
where
a matching
TrustsExternalIdentity exists: ?iam_role TrustsExternalIdentity cluster_oidc, with sub condition matching system:serviceaccount:{namespace}:{sa-name}
emit
| source type | WorkloadIdentity |
|---|---|
| source | <k8s ServiceAccount (WorkloadIdentity)> |
| target | <IAM Role from annotation (MachineIdentity/Role)> |
Narrative
Kubernetes ServiceAccount {sa.name} (namespace {sa.namespace}) maps to IAM role {role.name} via IRSA annotation. Mapping realized when the role trust sub condition is satisfied (system:serviceaccount:{sa.namespace}:{sa.name}).
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-irsa-ksa-maps-to-iam-role
emits: ExternalIdentityMapsTo
description: A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn maps to that IAM role;
the mapping is realized when the role trust allows the cluster OIDC issuer + sub for this SA.
match_record:
resource_type: k8s:ServiceAccount
field: annotations.eks.amazonaws.com/role-arn
where:
- 'a matching TrustsExternalIdentity exists: ?iam_role TrustsExternalIdentity cluster_oidc, with sub condition
matching system:serviceaccount:{namespace}:{sa-name}'
emit:
source_type: WorkloadIdentity
source: <k8s ServiceAccount (WorkloadIdentity)>
target: <IAM Role from annotation (MachineIdentity/Role)>
api_source: kubectl get serviceaccount -o json
evidence_field: metadata.annotations.eks.amazonaws.com/role-arn
properties:
trust_satisfied: <true if the role trust sub condition matches this SA; false if mismatch>
narrative: Kubernetes ServiceAccount {sa.name} (namespace {sa.namespace}) maps to IAM role {role.name}
via IRSA annotation. Mapping realized when the role trust sub condition is satisfied (system:serviceaccount:{sa.namespace}:{sa.name}).