🔐 Amazon EKS Pod Identity Now Supports Cross-Account Access — Simplified & Code-Free

#kubernetes #eks #aws #devops

🎯 Use Case

Say you have

🟦 EKS cluster in Account A
📦 S3 bucket or DynamoDB table in Account B

Now, your pods in Account A can automatically access resources in Account B, securely and transparently.

⚙️ How It Works

Two IAM roles are involved

PodIdentityRole in Account A (used by EKS)
TargetResourceRole in Account B (with access to S3/DynamoDB)

Use the new create-pod-identity-association API to link them

aws eks create-pod-identity-association \
  --cluster-name my-cluster \
  --namespace finance \
  --service-account report-generator \
  --role-arn arn:aws:iam::<AccountA>:role/PodIdentityRole \
  --target-role-arn arn:aws:iam::<AccountB>:role/TargetResourceRole

🔄 EKS handles IAM role chaining behind the scenes

Your application running inside the pod:

Gets credentials automatically from the identity service
Doesn’t need to know about role assumptions or accounts
Keeps running as usual — securely accessing remote AWS services

🧠 Why It’s Cool

✅ No code changes in your app
🔐 Secure cross-account access via IAM
🔁 Native support for role chaining
🛠️ Works with Cloud-native patterns
💼 Ideal for multi-account enterprise setups

🧘 Real-World Benefit

Let’s say your app in EKS reads daily data from an S3 bucket in another business unit.
Now, with a single Pod Identity association, your pod gets credentials to access that bucket — securely and automatically.