<p>In the Amazon EKS User Guide, there is <a href="https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html" rel="nofollow noreferrer">a page</a> dedicated to creating ALB ingress controllers by using an eponymous third-party tool, <a href="https://github.com/kubernetes-sigs/aws-alb-ingress-controller" rel="nofollow noreferrer">AWS ALB Ingress Controller for Kubernetes</a>.</p>

<p>Both the EKS user guide and the documentation for the controller have their own walkthroughs for how to set up the controller. </p>

<p>The <a href="https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/walkthrough/echoserver/" rel="nofollow noreferrer">walkthrough provided by the controller</a> has you either hard-code your AWS secret key into a <code>Deployment</code> manifest, or else install yet another third-party tool called <a href="https://github.com/jtblin/kube2iam" rel="nofollow noreferrer">Kube2iam</a>. </p>

<p>The <a href="https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html" rel="nofollow noreferrer">walkthrough in the AWS EKS user guide</a> has you post exactly the same <code>Deployment</code> manifest, but you don't have to modify it at all. Instead, you create both an IAM role (step 5) and a Kubernetes service account (step 4) for the controller, and then you link them together by annotating the service account with the ARN for the IAM role. Prima facie, this seems to be what Kube2iam is for.</p>

<p>This leads me to one of three conclusions, which I rank in rough order of plausibility:</p>

<ol>
<li>EKS contains the functionality of Kube2iam as one of its features (possibly by incorporating Kube2iam into its codebase), and so installing Kube2iam is superfluous.</li>
<li><code>eksctl</code> installs Kube2iam behind the scenes as part of <code>associate-iam-oidc-provider</code>.</li>
<li>The documentation for the controller was written for an earlier version of Kubernetes, and this functionality is now built into the stock control plane.</li>
</ol>

<p>Does anyone happen to know which it is? Why doesn't the AWS walkthrough need me to install Kube2iam?</p>

<blockquote>
  <p>Does anyone happen to know which it is? Why doesn't the AWS walkthrough need me to install Kube2iam?</p>
</blockquote>

<p>Yes, I can authoritatively answer this. In 09/2019 <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="noreferrer">we launched</a> a feature in EKS called <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="noreferrer">IAM Roles for Service Accounts</a>. This makes <code>kube2iam</code> and other solutions obsolete since we support least-privileges access control on the pod level now natively.</p>

<p>Also, yes, the ALB IC walkthrough should be updated.</p>
