~/ nmadiraju.com Amazon EKS · Pod Identity vs IRSA
arrow_back Back to nmadiraju
Decision Tool · Security

Goodbye IRSA, Hello EKS Pod Identity

IRSA (IAM Roles for Service Accounts) or EKS Pod Identity? Answer five questions to see which path fits, then follow one app through a cluster swap and its move to Pod Identity.

Pod Identity vs IRSA in 60 seconds

  • Both give Pods an IAM role. IRSA (IAM Roles for Service Accounts) uses a cluster-signed token; Pod Identity asks an agent on the node.
  • IRSA ties IAM to each cluster. Roles trust the cluster's OIDC provider, IAM's record of its token signer, so every new cluster needs IAM edits.
  • Pod Identity trusts EKS once. An association maps a service account to a role that names no cluster, so new clusters need no IAM edits.
  • Move safely. Create the association first; IRSA keeps answering until you remove its role annotation and restart. Old SDKs can't use the agent.
  • Where IRSA stays. Fargate, Windows nodes, Outposts, EKS Anywhere, Kubernetes you run yourself, and apps whose SDK is too old.

1Make the call

One EKS app's AWS credentials through IRSA and EKS Pod Identity, across two clusters Left, cluster prod-blue with the checkout Pods, its OIDC issuer and the Pod Identity Agent, and below it cluster prod-green with the same parts plus the node's metadata endpoint (IMDS). Middle, AWS STS, the EKS Auth API with its associations, and S3 bucket acme-receipts. Right, account 111122223333 with IAM OIDC providers and role checkout-s3 with its trust policy, and account 444455556666 with a cross-account target role. EKS CLUSTER prod-blue checkout Pods · payments OIDC issuer signs Pod tokens Pod Identity Agent · node-1 169.254.170.23 · DaemonSet add-on EKS CLUSTER prod-green checkout Pods · payments OIDC issuer green's own signs Pod tokens Pod Identity Agent 169.254.170.23 · node-7 IMDS node metadata AWS APIs · us-east-1 AWS STS AssumeRoleWithWebIdentity IRSA: the SDK calls it EKS Auth API AssumeRoleForPodIdentity ASSOCIATIONS Pod Identity: the agent calls it S3 bucket acme-receipts s3:GetObject what checkout reads ACCOUNT 111122223333 · IAM IAM OIDC providers IAM role checkout-s3 Allow s3:GetObject on acme-receipts/* TRUST POLICY ACCOUNT 444455556666 Target role receipts-ro trusts checkout-s3 via role chaining

    2Choose or diagnose: check yourself

    Check yourself