Answers: <p>Yes It does more than just creating a service account. It does three things:</p>
  <ol>
  <li>It Creates an IAM role.</li>
  <li>It attaches the desired iam-policy (--attach-policy-arn
  &lt;POLICY_ARN&gt;) to the created IAM role.</li>
  <li>It creates a new kubernetes service account annotated with the arn of the created IAM role.</li>
  </ol>
  <p>Now It's easy to declare the above steps using kubernetes and aws providers in terraform.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-28T12:22:18.583Z
Answers: 2021-01-30T11:41:04.263Z
Answers: 2021-01-30T11:41:04.263Z
Answers: HsnVahedi
Body: <p>AWS supports <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">IAM Roles for Service Accounts (IRSA)</a> that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.</p>
  <p>To do so, one has to create an <a href="https://eksctl.io/usage/iamserviceaccounts/" rel="nofollow noreferrer">iamserviceaccount</a> in an EKS cluster:</p>
  <pre><code>eksctl create iamserviceaccount \
      --name &lt;AUTOSCALER_NAME&gt; \
      --namespace kube-system \
      --cluster &lt;CLUSTER_NAME&gt; \
      --attach-policy-arn &lt;POLICY_ARN&gt; \
      --approve \
      --override-existing-serviceaccounts
  </code></pre>
  <p>The problem is that I don't want to use the above <code>eksctl</code> command because I want to declare my infrastructure using <code>terraform</code>.</p>
  <p>Does eksctl command do anything other than creating a service account? If it only creates a service account, what is the <code>YAML</code> representation of it?</p>
  
Tags: <kubernetes><amazon-web-services><terraform><aws-iam><eks>
Title: What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
UserDisplayName: HsnVahedi
ThreadText: # What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
  
  (Asked by: username_0 on 2021-01-28)
  
  AWS supports [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.
  
  To do so, one has to create an [iamserviceaccount](https://eksctl.io/usage/iamserviceaccounts/) in an EKS cluster:
  
  ```
  eksctl create iamserviceaccount \
      --name <AUTOSCALER_NAME> \
      --namespace kube-system \
      --cluster <CLUSTER_NAME> \
      --attach-policy-arn <POLICY_ARN> \
      --approve \
      --override-existing-serviceaccounts
  
  ```
  
  The problem is that I don't want to use the above `eksctl` command because I want to declare my infrastructure using `terraform`.
  
  Does eksctl command do anything other than creating a service account? If it only creates a service account, what is the `YAML` representation of it?
  
  **Tags:** kubernetes, amazon-web-services, terraform, aws-iam, eks
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-01-28. Score: 2 | Accepted answer
  
  Yes It does more than just creating a service account. It does three things:
  
  1. It Creates an IAM role.
  2. It attaches the desired iam-policy (--attach-policy-arn
     <POLICY\_ARN>) to the created IAM role.
  3. It creates a new kubernetes service account annotated with the arn of the created IAM role.
  
  Now It's easy to declare the above steps using kubernetes and aws providers in terraform.
  
  
  ---
  
  