eksctl create iamserviceaccount accepts wildcard subject patterns

Introduced 2026-02-06 · score 0.98

HOW TO USE IT

When multiple service accounts share a naming pattern, run `eksctl create iamserviceaccount` with `--subject-pattern="app-*"`; this makes the trust policy use `StringLike`. Use the narrowest pattern needed, since `*` allows any service account in the namespace to assume the role.

eksctl create iamserviceaccount --cluster=<clusterName> --name=<serviceAccountName> --namespace=<serviceAccountNamespace> --attach-policy-arn=<policyARN> --subject-pattern="app-*"

eksctl create iamserviceaccount --config-file=<path>

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
iam:
  withOIDC: true
  serviceAccounts:
    - metadata:
        name: <serviceAccountName>
        namespace: <serviceAccountNamespace>
      attachPolicyARNs:
        - <policyARN>
      subjectPattern: "app-*"

WHY THIS HELPS

Configure an IAM role trust policy for service accounts whose names share a pattern.

REQUIREMENTS AND LIMITATIONS

Version: v0.222.0
--cluster (required): EKS cluster name.
--name (required): Service account name; example uses `app-base`.
--namespace: Service account namespace; defaults to `default`.
--attach-policy-arn: Policy ARN to attach; can be specified multiple times. The wildcard example supplies one.
--subject-pattern: Wildcard pattern for trusted service account subjects; uses the `StringLike` condition instead of `StringEquals`.
subjectPattern: Config-file property for the service account subject wildcard pattern.
iam.withOIDC (required): Set `true` when managing IAM service accounts through the config file.
iam.serviceAccounts (required): Config-file list of service accounts to manage.
metadata.name (required): Service account name in the config entry.
metadata.namespace: Namespace in the config entry; if unset, `default` is used.
attachPolicyARNs: List of policy ARNs to attach in the config entry.
Prerequisite: IRSA requires Kubernetes 1.13 or above.
Prerequisite: The cluster's IAM OIDC provider must be associated; the docs provide `eksctl utils associate-iam-oidc-provider --cluster=<clusterName>` to enable it.
Wildcard patterns are used with `--subject-pattern`.
A broad pattern like `*` allows any service account in the namespace to assume the IAM role.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card

Tools change faster than your agent’s training data.

Changes

eksctl create iamserviceaccount accepts wildcard subject patterns