aws-eks-pod-executes-as-irsa-role
A pod whose ServiceAccount has an IRSA annotation executes as the annotated IAM role (credentials delivered by token projection + STS).
match (record)
{
"field": "annotations.eks.amazonaws.com/role-arn",
"resource_type": "k8s:ServiceAccount"
}
emit
| source type | KubernetesWorkload |
|---|---|
| source | <KubernetesWorkload (any pod running as this ServiceAccount)> |
| target | <IAM Role from eks.amazonaws.com/role-arn annotation (MachineIdentity/Role)> |
Narrative
Pods running as ServiceAccount {sa.name} (namespace {sa.namespace}) execute as IAM role {role.name} via IRSA. The pod receives a projected token volume which it exchanges for STS credentials (sts:AssumeRoleWithWebIdentity).
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-pod-executes-as-irsa-role
emits: ExecutesAs
description: A pod whose ServiceAccount has an IRSA annotation executes as the annotated IAM role (credentials
delivered by token projection + STS).
match_record:
resource_type: k8s:ServiceAccount
field: annotations.eks.amazonaws.com/role-arn
emit:
source_type: KubernetesWorkload
source: <KubernetesWorkload (any pod running as this ServiceAccount)>
target: <IAM Role from eks.amazonaws.com/role-arn annotation (MachineIdentity/Role)>
api_source: kubectl get serviceaccount -n <namespace> -o json
evidence_field: metadata.annotations.eks.amazonaws.com/role-arn
narrative: Pods running as ServiceAccount {sa.name} (namespace {sa.namespace}) execute as IAM role {role.name}
via IRSA. The pod receives a projected token volume which it exchanges for STS credentials (sts:AssumeRoleWithWebIdentity).