aws-eks-pod-identity-ksa-maps-to-iam-role
An EKS Pod Identity Association explicitly maps a namespace:SA pair to an IAM role; the mapping is backed by the role trust trusting pods.eks.amazonaws.com.
match (record)
{
"field": "roleArn",
"resource_type": "AWS::EKS::PodIdentityAssociation"
}
emit
| source type | WorkloadIdentity |
|---|---|
| source | <k8s ServiceAccount (WorkloadIdentity) in namespace from association> |
| target | <IAM Role (roleArn)> |
Narrative
EKS Pod Identity Association maps {namespace}:{serviceAccount} to IAM role {role.name}. Backed by role trust trusting pods.eks.amazonaws.com.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-pod-identity-ksa-maps-to-iam-role
emits: ExternalIdentityMapsTo
description: An EKS Pod Identity Association explicitly maps a namespace:SA pair to an IAM role; the mapping
is backed by the role trust trusting pods.eks.amazonaws.com.
match_record:
resource_type: AWS::EKS::PodIdentityAssociation
field: roleArn
emit:
source_type: WorkloadIdentity
source: <k8s ServiceAccount (WorkloadIdentity) in namespace from association>
target: <IAM Role (roleArn)>
api_source: eks:DescribePodIdentityAssociation
evidence_field: roleArn
properties:
namespace: <association.namespace>
service_account: <association.serviceAccount>
narrative: EKS Pod Identity Association maps {namespace}:{serviceAccount} to IAM role {role.name}. Backed
by role trust trusting pods.eks.amazonaws.com.