<p>I am trying to attach an IAM role to a pod's service account from within the POD in EKS.</p>
<pre><code>kubectl annotate serviceaccount -n $namespace $serviceaccount eks.amazonaws.com/role-arn=$ARN
</code></pre>
<p>The current role attached to the <code>$serviceaccount</code>is outlined below:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: common-role
rules:
  - apiGroups: [&quot;&quot;]
    resources:
      - event
      - secrets
      - configmaps
      - serviceaccounts
     verbs:
      - get
      - create
</code></pre>
<p>However, when I execute the <code>kubectl</code> command I get the following:</p>
<pre><code>error from server (forbidden): serviceaccounts $serviceaccount is forbidden: user &quot;system:servi....&quot; cannot get resource &quot;serviceaccounts&quot; in API group &quot;&quot; ...
</code></pre>
<p>Is my role correct? Why can't I modify the service account?</p>

SSF
<p>While your role appears to be correct, please keep in mind that when executing <code>kubectl</code>, the RBAC permissions of your account in <code>kubeconfig</code> are relevant for whether you are allowed to perform an action.</p>
<p>From your question, I understand that your role is attached to the service account you are trying to annotate, which is irrelevant to the <code>kubectl</code> permission check.</p>
