Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 941 discussion

This was in my Exam today. Good Luck!!!!!!!!!!!!

A - Attaching policies to the IAM role of the EKS nodes provides broad permissions to all pods running on the nodes. IRSA is designed to eliminate such over-permissive configurations. B - AWS resource access is managed by IAM, not Kubernetes network policies. C - EKS cluster’s IAM role is not meant to handle granular access for service accounts. D - Ensures fine-grained access control at the service account level. E - Allows Kubernetes service accounts to assume IAM roles securely.

https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html => DE

probably D and E https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-enable-IAM.html

chatgpt: D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role: Granular Access Control: By defining an IAM role with the necessary permissions and annotating the Kubernetes service accounts with the ARN of this IAM role, you can achieve fine-grained access control for specific AWS resources. This allows each service account to have only the permissions it needs. E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider: IRSA Integration: To enable IRSA, your EKS cluster must be associated with an OpenID Connect (OIDC) identity provider. This trust relationship allows Kubernetes service accounts to assume IAM roles, enabling secure and granular access to AWS resources.

my educated guess C, E