<p>I have a Kubernetes EKS cluster on AWS, an my goal is to be able to watch particular config maps in my Spring Boot application.
On my local environment everything works correctly, but when I use this setup inside AWS I get forbidden state and my application fails to run.
I've created a Service Account but don't understand how to create Terraform script which can assign the needed IAM Role.
Any help would be appreciated.</p>

<p>This depends on several things.</p>
<p>An AWS IAM Role can be provided to Pods in different ways, but the recommended way now is to use <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="noreferrer">IAM Roles for Service Accounts, IRSA</a>.</p>
<p>Depending on how you provision the Kubernetes cluster with Terraform, this is also done in different ways. If you use <a href="https://aws.amazon.com/eks/" rel="noreferrer">AWS EKS</a> and provision the cluster using the <a href="https://github.com/terraform-aws-modules/terraform-aws-eks" rel="noreferrer">Terraform AWS EKS module</a>, then you should set <a href="https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/variables.tf#L326" rel="noreferrer">enable_irsa</a> to <code>true</code>.</p>
<p>You then need to create an IAM Role for you application (Pods), and you need to return the ARN for the IAM Role. This can be done using the <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role" rel="noreferrer">aws_iam_role</a> resource.</p>
<p>You need to create a Kubernetes ServiceAccount for your pod, it can be created with Terraform, but many want to use Yaml for Kubernetes resources. The ServiceAccount need to be annotated with the IAM Role ARN, like:</p>
<pre><code>annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::14xxx84:role/my-iam-role
</code></pre>
<p>See the <a href="https://www.eksworkshop.com/beginner/110_irsa/" rel="noreferrer">EKS workshop for IAM Roles for Service Accounts</a> lesson for a guide through this. However, it does not use Terraform.</p>
