SAA-C03 Q606 · Security

Question

A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA). Which combination of solutions will meet these requirements? (Choose two)

Accepted Answer

The question asks how to implement **IAM Roles for Service Accounts (IRSA)** in EKS. IRSA has two essential components:

**Answer D — IAM Role + Service Account Annotation:**
1. You create an IAM role with a policy granting only the specific AWS permissions needed (e.g., S3 read, DynamoDB write).
2. You annotate the Kubernetes service account with `eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`.
3. When a pod uses that service account, the EKS Pod Identity webhook automatically injects temporary AWS credentials (via `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` environment variables) into the pod.
4. This provides **granular, per-pod** access to AWS resources — satisfying the requirement for secure and granular access.

**Answer E — OIDC Identity Provider Trust Rela

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips