EKS IRSA Role Factory

IRSA Without the IAM Archaeology

Getting IAM Roles for Service Accounts right means correctly wiring the OIDC provider, trust policies, and service account annotations. This Terraform module does it in one call — and ships pre-built policy attachments for the five AWS services most pods actually need.

What is Included

• Terraform module: irsa-role — creates an IAM role with correct OIDC trust for a specified namespace and service account
• Pre-built policy modules for S3 (scoped to prefix), SQS (send/receive/delete), Secrets Manager (read by path), DynamoDB (table-scoped CRUD), and ECR (pull-only)
• Outputs: role ARN, role name, and annotated service account manifest ready to apply

Developer Experience

Pass in your cluster OIDC URL, namespace, and service account name. Choose which policy modules to attach. Get back a role ARN ready to annotate onto your service account. No manual trust policy JSON editing.

What You Get

• modules/irsa-role/ — core role factory
• modules/policies/ — five policy modules with variable scope inputs
• examples/ — working examples for a typical app needing S3 and Secrets Manager access
• README.md explaining OIDC mechanics and the annotation pattern

Requirements

• Existing EKS cluster with OIDC provider enabled
• Terraform >= 1.3, AWS provider >= 5.0
• IAM permissions to create roles and policies