Simplified Kubernetes version 1.12 OIDC JSON web token, Amazon EKS now hosts a public OIDC discovery endpoint per cluster containing the signing keys for the JSON web tokens so external systems, like IAM, can validate and accept the OIDC tokens issued by Kubernetes.

AWS guide for this is at: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

AWS guide at github: https://github.com/aws/amazon-eks-pod-identity-webhook/

Steps are mentioned below

1. Get OIDC provider URL: aws eks describe-cluster --name cluster_name --query "cluster.identity.oidc.issuer" --output text

2. Create the role with federated identity and get ARN for role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::AWS_ACCOUNT_ID:oidc-provider/OIDC_PROVIDER"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "OIDC_PROVIDER:sub": "system:serviceaccount:SERVICE_ACCOUNT_NAMESPACE:SERVICE_ACCOUNT_NAME"
        }
      }
    }
  ]
}

Keep in mind, you need to mentioned NAMESPACE over here, ensure you have namespace with name SERVICE_ACCOUNT_NAMESPACE.

3. Create service account in kubernetes

apiVersion: v1
kind: ServiceAccount
metadata:
  name: SERVICE_ACCOUNT_NAME
  annotations:
    eks.amazonaws.com/role-arn: ARN_OF_ABOVE_IAM_ROLE

4. Run a pod using serviceaccount

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: SERVICE_ACCOUNT_NAME
  ...

If all done properly, you will be able to assume the role in your k8s pod. Try running any python script in docker container like,

import boto3
client = boto3.client('iam') 
response = client.list_users()
for x in response['Users']:
print (x['UserName']) 

Given the permission to IAM this would list the users in AWS Account.

Reference:

• https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
• https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
• https://github.com/aws/amazon-eks-pod-identity-webhook/