A pod running on Amazon EKS needs to call AWS APIs under a narrowly scoped IAM role, and the security team forbids storing access keys in the container. Which approach meets the requirement?
Show answer and explanation
Answer: A
IAM Roles for Service Accounts links a Kubernetes service account to an IAM role by trusting the cluster's OIDC identity provider. Pods that use that service account receive short-lived credentials through the EKS pod identity webhook, and the AWS SDK picks them up automatically.
Because every workload can have its own role, permissions stay scoped to the pod instead of the whole node.
Why the other options are wrong
- B. ConfigMaps are not secret storage, and long-lived keys there can leak through manifests or API access.
- C. A node instance profile is shared by every pod on that node, so it cannot enforce per-workload least privilege.
- D. kubectl proxy only forwards requests to the Kubernetes API server; it grants no AWS API permissions.