<p>Yes It does more than just creating a service account. It does three things:</p>
<ol>
<li>It Creates an IAM role.</li>
<li>It attaches the desired iam-policy (--attach-policy-arn
&lt;POLICY_ARN&gt;) to the created IAM role.</li>
<li>It creates a new kubernetes service account annotated with the arn of the created IAM role.</li>
</ol>
<p>Now It's easy to declare the above steps using kubernetes and aws providers in terraform.</p>

CC BY-SA 4.0
2021-01-28T12:22:18.583Z
2021-01-30T11:41:04.263Z
2021-01-30T11:41:04.263Z
HsnVahedi
<p>AWS supports <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">IAM Roles for Service Accounts (IRSA)</a> that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.</p>
<p>To do so, one has to create an <a href="https://eksctl.io/usage/iamserviceaccounts/" rel="nofollow noreferrer">iamserviceaccount</a> in an EKS cluster:</p>
<pre><code>eksctl create iamserviceaccount \
    --name &lt;AUTOSCALER_NAME&gt; \
    --namespace kube-system \
    --cluster &lt;CLUSTER_NAME&gt; \
    --attach-policy-arn &lt;POLICY_ARN&gt; \
    --approve \
    --override-existing-serviceaccounts
</code></pre>
<p>The problem is that I don't want to use the above <code>eksctl</code> command because I want to declare my infrastructure using <code>terraform</code>.</p>
<p>Does eksctl command do anything other than creating a service account? If it only creates a service account, what is the <code>YAML</code> representation of it?</p>

<kubernetes><amazon-web-services><terraform><aws-iam><eks>
What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
HsnVahedi
# What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?

(Asked by: username_0 on 2021-01-28)

AWS supports IAM Roles for Service Accounts (IRSA) that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.
To do so, one has to create an iamserviceaccount in an EKS cluster:
eksctl create iamserviceaccount \
    --name  \
    --namespace kube-system \
    --cluster  \
    --attach-policy-arn  \
    --approve \
    --override-existing-serviceaccounts

The problem is that I don't want to use the above eksctl command because I want to declare my infrastructure using terraform.
Does eksctl command do anything other than creating a service account? If it only creates a service account, what is the YAML representation of it?

**Tags:** kubernetes, amazon-web-services, terraform, aws-iam, eks


---

## 1 answers

### Answer by username_0 on 2021-01-28. Score: 2 | Accepted answer

Yes It does more than just creating a service account. It does three things:

1. It Creates an IAM role.
2. It attaches the desired iam-policy (--attach-policy-arn
   ) to the created IAM role.
3. It creates a new kubernetes service account annotated with the arn of the created IAM role.

Now It's easy to declare the above steps using kubernetes and aws providers in terraform.


---

