{
  "slug": "eksctl-create-iamserviceaccount-accepts-wildcard-subject-patterns-643ca1d539b0",
  "title": "eksctl create iamserviceaccount accepts wildcard subject patterns",
  "tools": [
    "eksctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-06T21:34:33.000Z",
  "announced_at": "2026-02-06T21:34:33.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When multiple service accounts share a naming pattern, run `eksctl create iamserviceaccount` with `--subject-pattern=\"app-*\"`; this makes the trust policy use `StringLike`. Use the narrowest pattern needed, since `*` allows any service account in the namespace to assume the role.",
    "examples": [
      "eksctl create iamserviceaccount --cluster=<clusterName> --name=<serviceAccountName> --namespace=<serviceAccountNamespace> --attach-policy-arn=<policyARN> --subject-pattern=\"app-*\"",
      "eksctl create iamserviceaccount --config-file=<path>",
      "apiVersion: eksctl.io/v1alpha5\nkind: ClusterConfig\niam:\n  withOIDC: true\n  serviceAccounts:\n    - metadata:\n        name: <serviceAccountName>\n        namespace: <serviceAccountNamespace>\n      attachPolicyARNs:\n        - <policyARN>\n      subjectPattern: \"app-*\""
    ],
    "gotchas": [
      "Version: v0.222.0",
      "--cluster (required): EKS cluster name.",
      "--name (required): Service account name; example uses `app-base`.",
      "--namespace: Service account namespace; defaults to `default`.",
      "--attach-policy-arn: Policy ARN to attach; can be specified multiple times. The wildcard example supplies one.",
      "--subject-pattern: Wildcard pattern for trusted service account subjects; uses the `StringLike` condition instead of `StringEquals`.",
      "subjectPattern: Config-file property for the service account subject wildcard pattern.",
      "iam.withOIDC (required): Set `true` when managing IAM service accounts through the config file.",
      "iam.serviceAccounts (required): Config-file list of service accounts to manage.",
      "metadata.name (required): Service account name in the config entry.",
      "metadata.namespace: Namespace in the config entry; if unset, `default` is used.",
      "attachPolicyARNs: List of policy ARNs to attach in the config entry.",
      "Prerequisite: IRSA requires Kubernetes 1.13 or above.",
      "Prerequisite: The cluster's IAM OIDC provider must be associated; the docs provide `eksctl utils associate-iam-oidc-provider --cluster=<clusterName>` to enable it.",
      "Wildcard patterns are used with `--subject-pattern`.",
      "A broad pattern like `*` allows any service account in the namespace to assume the IAM role."
    ]
  },
  "why_it_matters": "Configure an IAM role trust policy for service accounts whose names share a pattern.",
  "sources": [
    "https://github.com/eksctl-io/eksctl/releases/tag/v0.222.0",
    "https://github.com/eksctl-io/eksctl/pull/8629",
    "https://github.com/eksctl-io/eksctl/blob/v0.222.0/userdocs/src/usage/iamserviceaccounts.md"
  ],
  "rank": 0.9803,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-7187fcd6651ae132-1:gate",
    "evidence_hash": "e975ca89357f26093481b0af9c0832ece37a698260857c74e4848501ad2c7f68"
  },
  "review": {
    "draft_hash": "00b83d92ecd3f762a7c2852cbada33fc9c793bb6d7e6b3068cf4c152fc76218e",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}