Lab 04 — Secure Kubernetes Authentication with OIDC & IAM Roles for Service Accounts (IRSA)

Mission Information

Item	Details
Lab ID	K8S-IAM-LAB-04
Difficulty	Advanced
Estimated Time	3–4 Hours
Environment	Amazon EKS (Preferred), kind (Concept Demonstration)
Platform	AWS
Cost	AWS Free Tier / Minimal Charges (EKS cluster costs may apply)
Primary Role	Kubernetes Security Engineer
Module	Module 02 — Kubernetes Identity & Access Management
Previous Lab	Lab 03 — Implement Kubernetes Roles, ClusterRoles & Least Privilege Access

Mission Scenario

CloudNova Technologies has modernised its application platform by migrating to Amazon Elastic Kubernetes Service (Amazon EKS).

Historically, application teams embedded AWS Access Keys and Secret Access Keys inside:

Kubernetes Secrets
Environment Variables
Configuration Files
CI/CD Pipelines

A recent security assessment identified multiple risks:

Long-lived AWS credentials stored inside containers
Shared IAM users across applications
Excessive AWS permissions
Credential rotation challenges
Poor auditability
High risk of credential compromise

To address these issues, the Cloud Security Team has decided to implement IAM Roles for Service Accounts (IRSA) using OpenID Connect (OIDC).

Your task is to migrate workloads from static AWS credentials to short-lived federated identities while enforcing least privilege and improving the security posture of the Kubernetes platform.

Learning Objectives

By completing this lab, you will learn how to:

Understand Kubernetes authentication
Understand OpenID Connect (OIDC)
Understand workload identity federation
Configure an OIDC provider for Amazon EKS
Create IAM policies
Create IAM roles for Kubernetes workloads
Configure IAM trust policies
Associate IAM roles with Service Accounts
Validate AWS authentication from Pods
Eliminate long-lived AWS credentials
Troubleshoot IRSA authentication
Perform an enterprise authentication assessment

Enterprise Architecture

                    Amazon EKS Cluster

                Kubernetes API Server
                         │
                  Service Account
                         │
                  OIDC JWT Token
                         │
             Amazon STS AssumeRoleWithWebIdentity
                         │
                    IAM Role (IRSA)
                         │
                Temporary AWS Credentials
                         │
        ┌────────────────┼────────────────┐
        │                │                │
        ▼                ▼                ▼
     Amazon S3      AWS Secrets      Amazon DynamoDB
                     Manager

Lab Outcomes

By the end of this lab, you will have:

Enabled OIDC for an Amazon EKS cluster
Created IAM Policies
Created IAM Roles
Configured IAM Trust Relationships
Associated IAM Roles with Kubernetes Service Accounts
Validated temporary AWS credentials
Removed static AWS credentials
Produced an IRSA security assessment report

Prerequisites

Before starting:

Complete Module 01
Complete Module 02 Labs 01–03
AWS Account
Amazon EKS Cluster
AWS CLI configured
kubectl configured
eksctl installed
IAM permissions to manage EKS and IAM resources

Enterprise Background

Traditional Kubernetes applications authenticate to AWS using long-lived IAM user credentials.

Example:

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

Problems include:

Credentials can be stolen.
Manual rotation is required.
Secrets are copied between environments.
Difficult to audit.
Broad permissions are common.

IRSA removes these risks by issuing temporary credentials through AWS Security Token Service (STS).

Authentication Flow

Application Pod

↓

Service Account

↓

OIDC Token

↓

Amazon STS

↓

IAM Role

↓

Temporary Credentials

↓

AWS Services

Task 01 — Verify the Amazon EKS Cluster

Verify cluster connectivity.

kubectl cluster-info

kubectl get nodes

Verify AWS identity.

aws sts get-caller-identity

Record:

AWS Account ID
IAM Identity
Cluster Name
AWS Region

Task 02 — Review Existing Authentication

Inspect current Service Accounts.

kubectl get sa -A

Review Pods.

kubectl get pods -A

Discuss:

Which workloads currently authenticate to AWS?

How are credentials provided?

Task 03 — Verify or Enable the OIDC Provider

List OIDC providers.

aws iam list-open-id-connect-providers

Describe the EKS cluster.

aws eks describe-cluster \
--name <cluster-name>

If the OIDC provider is not associated, enable it using:

eksctl utils associate-iam-oidc-provider \
--cluster <cluster-name> \
--approve

Verify the provider has been created successfully.

Task 04 — Create an IAM Policy

Create a least-privilege policy that allows read-only access to a specific Amazon S3 bucket.

Example permissions:

ListBucket
GetObject

Discuss why wildcard (*) permissions should be avoided.

Task 05 — Create an IAM Role for IRSA

Create an IAM role.

Configure the trust policy to allow only the designated Kubernetes Service Account to assume the role.

Review:

Principal
Federated identity
OIDC provider
Conditions

Explain the importance of restricting the role to a single namespace and Service Account.

Task 06 — Create a Kubernetes Service Account

Create:

inventory-sa

Annotate the Service Account with the IAM role ARN.

Example:

metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT-ID>:role/inventory-irsa-role

Deploy the Service Account.

Verify:

kubectl describe sa inventory-sa

Task 07 — Deploy a Test Application

Deploy an application using the Service Account.

Configure:

serviceAccountName: inventory-sa

Verify the Pod is running.

Task 08 — Validate Temporary AWS Credentials

Connect to the Pod.

kubectl exec -it <pod-name> -- /bin/sh

Run:

aws sts get-caller-identity

Observe:

Temporary credentials
IAM role name
AWS account ID

Confirm that no AWS Access Keys are configured manually.

Task 09 — Access Amazon S3

Attempt to list the approved S3 bucket.

aws s3 ls s3://<approved-bucket>

Attempt to access an unauthorised bucket.

Expected:

AccessDenied

Discuss how IAM policies enforce least privilege.

Task 10 — Review Projected Tokens

Inspect the projected Service Account token.

ls \
/var/run/secrets/eks.amazonaws.com/serviceaccount

Review:

Token
Certificate
Namespace information

Explain how OIDC tokens differ from static credentials.

Task 11 — Simulate a Security Incident

Scenario:

A developer stores AWS Access Keys inside a Kubernetes Secret.

Tasks:

Identify the risks.
Compare with IRSA.
Recommend remediation.
Document the incident.

Task 12 — Compare Authentication Models

Complete the following comparison.

Authentication Method	Security	Rotation	Auditability	Recommendation
IAM User Keys
EC2 Instance Profile
Kubernetes Secret
IRSA

Discuss why IRSA is preferred for Amazon EKS.

Task 13 — Authentication Security Review

Evaluate:

OIDC Provider
IAM Policy Scope
Trust Relationship
Service Account
Temporary Credentials
Least Privilege
Namespace Isolation
Audit Logging

Classify findings:

Compliant
Requires Improvement
Non-Compliant

Task 14 — Enterprise Assessment

Complete the following assessment.

Control	Status
OIDC Enabled
IAM Role Configured
Least Privilege Applied
Temporary Credentials Used
Static Credentials Removed
Trust Policy Restricted
Service Account Annotated
Authentication Validated

Task 15 — Evidence Collection

Capture evidence for:

EKS Cluster
OIDC Provider
IAM Policy
IAM Role
Trust Policy
Service Account
Pod Configuration
STS Identity
S3 Access Validation
Authentication Assessment

Task 16 — Clean Up

Delete:

Test Deployment
Kubernetes Service Account
IAM Role
IAM Policy (if created exclusively for this lab)

Verify all temporary resources have been removed.

Skills Developed

By completing this lab you will be able to:

Configure OIDC for Amazon EKS
Implement IAM Roles for Service Accounts (IRSA)
Design IAM trust policies
Create least-privilege IAM policies
Associate IAM roles with Kubernetes Service Accounts
Validate temporary AWS credentials
Secure workload authentication
Replace static AWS credentials
Troubleshoot IRSA authentication
Conduct enterprise workload identity reviews

Knowledge Check

Question 1

What is the primary purpose of IAM Roles for Service Accounts (IRSA)?

A. Encrypt Kubernetes Secrets
B. Provide temporary AWS credentials to Kubernetes workloads without storing long-lived access keys
C. Schedule Pods across Worker Nodes
D. Replace Kubernetes RBAC

Answer: B

Question 2

Which AWS service issues temporary credentials for IRSA?

A. Amazon S3
B. AWS Security Token Service (STS)
C. Amazon CloudWatch
D. AWS Config

Answer: B

Question 3

Why is an OIDC provider required for IRSA?

A. To increase Pod performance
B. To establish a trusted identity federation between Amazon EKS and AWS IAM
C. To create Kubernetes Namespaces
D. To manage Network Policies

Answer: B

Question 4

Which annotation associates a Kubernetes Service Account with an IAM Role?

A. eks.amazonaws.com/cluster-name
B. eks.amazonaws.com/role-arn
C. aws.amazon.com/iam-user
D. kubernetes.io/service-account

Answer: B

Question 5

Which authentication method is considered the most secure for Amazon EKS workloads?

A. Hard-coded AWS Access Keys
B. IAM User credentials stored in Kubernetes Secrets
C. IAM Roles for Service Accounts (IRSA)
D. Shared administrator credentials

Answer: C

Lab Summary

In this lab, you implemented secure workload authentication for Amazon EKS using OpenID Connect (OIDC) and IAM Roles for Service Accounts (IRSA). You enabled an OIDC identity provider, created least-privilege IAM policies and roles, configured trust relationships, and associated an IAM role with a Kubernetes Service Account.

You validated that workloads received temporary AWS credentials from AWS Security Token Service (STS) without storing long-lived access keys inside containers or Kubernetes Secrets. By replacing static credentials with federated workload identities, you significantly reduced credential management overhead, improved auditability, and strengthened the overall security posture of the Kubernetes environment.

These authentication patterns are considered AWS best practice and are widely adopted in production Amazon EKS environments to securely integrate Kubernetes workloads with AWS services.

What’s Next?

➡️ Next Module: Lab 05 — Kubernetes Identity Audit