IAM roles for service accounts (IRSA) and EKS Pod Identity eliminate the need for developers to manage credentials. Either mechanism gives a workload its own IAM identity, so it authenticates to AWS APIs with short-lived credentials instead of long-lived access keys. Workloads without one fall back to the node instance role and inherit every permission granted to the node group.
