eksctl create/update pod identity associations accept --policy

Introduced 2026-02-14 · score 0.95

HOW TO USE IT

When creating or updating a pod identity association with an additional policy, pass it with `--policy` and disable session tags. The policy adds restrictions beyond the IAM policies attached to the role.

WHY THIS HELPS

Create or update a pod identity association with an additional policy.

REQUIREMENTS AND LIMITATIONS

• Version: v0.223.0
• --cluster <cluster> (required): Name of the target cluster.
• --namespace <namespace> (required): Namespace of the service account or association.
• --service-account-name <service-account> (required): Name of the service account for the association.
• --policy <policy-document>: Optional policy adding restrictions beyond the IAM policies attached to the role. The docs do not specify the CLI document format.
• --disable-session-tags: Disable EKS Pod Identity session tags; required when passing `--policy`.
• Prerequisite: The `eks-pod-identity-agent` add-on must be installed on the cluster before creating an association; EKS Auto Mode clusters have it pre-installed.

FIRST-PARTY EVIDENCE

• https://github.com/eksctl-io/eksctl/releases/tag/v0.223.0
• https://github.com/eksctl-io/eksctl/pull/8674
• https://github.com/eksctl-io/eksctl/blob/v0.223.0/pkg/ctl/create/pod_identity_association.go
• https://github.com/eksctl-io/eksctl/blob/v0.223.0/pkg/ctl/update/pod_identity_association.go
• https://docs.aws.amazon.com/eks/latest/eksctl/pod-identity-associations.html

Check the installed version and the source before using it. Entry JSON

Report a problem with this card