Defaulting to Pod Identity Before Fargate Forces You Back to IRSA

Decision drivers

Whether any workload in the cluster runs on Fargate (forces IRSA for that workload regardless of the rest)
Whether cross-account IAM role access is required
Number of clusters sharing IAM roles (Pod Identity's reusability advantage compounds with cluster count)
Whether the 100-OIDC-providers-per-account limit is a real constraint at the org's current cluster count

IRSA trades setup complexity (a per-cluster OIDC provider, a trust policy tied to a specific service account and audience) for the most battle-tested, broadly-compatible way to grant pods scoped AWS permissions. EKS Pod Identity trades some of that flexibility for significantly simpler setup — no per-cluster OIDC provider, no bumping into the 100-OIDC-providers-per-account limit, and IAM roles reusable across multiple clusters without re-wiring trust policies each time. This is the identity model materially distinct from vanilla IAM that the spec's Slot A is built around.

Gated · a free account unlocks the full catalog

This page is part of the AWS track's gated content. Sign in — free — to keep reading. A free account unlocks the full catalog.