<p>I found <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html" rel="nofollow noreferrer">that documentation</a> that we can add AWS IAM role to kubernetes serviceaccount and attach to Pods. And what I'm supposed to do is I want to attach that service account to DaemonSet instead of Pods level permission. But I configured same as that documentation and attached to DaemonSet but I've encountered following error message after that:</p>
<p><code>Aws::STS::Errors::AccessDenied error=&quot;Not authorized to perform sts:AssumeRoleWithWebIdentity</code></p>
<p>Is that meant those type of serviceaccount with IAM role cannot be attached to DaemonSet?</p>

<blockquote>
<p>Is that meant those type of serviceaccount with IAM role cannot be attached to DaemonSet?</p>
</blockquote>
<p>No,there shouldn't be any issues with that. I checked <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="nofollow noreferrer">here</a> and there is an example with service account in a deployment.</p>
<hr />
<p>As @PPShein mentioned in comments the issue occurs because he forgot to add the <code>openid_url</code>.</p>
<p>Please refer to <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html" rel="nofollow noreferrer">this</a> and <a href="https://marcincuber.medium.com/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c" rel="nofollow noreferrer">this</a> documentation.</p>
