<p>I have an EKS deployment with a service account with policy and role that enable access to S3.</p>
<p>This works well for root account in the container. The container can execute <code>aws s3 cp ...</code> with no issue.</p>
<p>The problem is that another user cannot. It gets <code>AccessDenied</code> from the S3 service, meaning it does not have the correct credentials.</p>
<p>So my question is: how to give rights to another user in the container (which is linux based) in this case?</p>
<p>(I don't think it's specific to Eks as service accounts are generic to kubernetes.)</p>

<p>You can check out the reference for how IAM roles for service accounts work in k8s <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#pod-configuration" rel="nofollow noreferrer">here</a>.<br />
In short, in order to allow another user to use the IAM role the same environment variables have to be configured for that user, and it needs to be able to access the path specified in the <code>AWS_WEB_IDENTITY_TOKEN_FILE</code> variable.<br />
Once both of these prerequisites are met, the user should be able to use the same identity as the root user.</p>
