Introduction
If you're running apps on Amazon EKS, you've faced this challenge: your pods need to talk to AWS services (S3, DynamoDB, SQS), and you must provide credentials securely without baking long-lived access keys into a Kubernetes Secret.
For years, the standard was IRSA (IAM Roles for Service Accounts). It's secure, but setting it up can feel like assembling complex furniture with a vague manual. AWS introduced EKS Pod Identity as a simpler, native alternative.
Having managed both architectures and handled migrations between them, here is the breakdown of how they work under the hood, the gotchas, and how to choose.
The Anti-Pattern: Static Credentials
