The AWS EKS Pod Identity Agent runs on Amazon EKS nodes and exchanges Kubernetes service account tokens for temporary AWS IAM credentials, providing pods with IAM roles without using IRSA or instance profiles.
The AWS EKS Pod Identity Agent is a Kubernetes node agent that delivers temporary AWS IAM credentials to pods running on Amazon EKS clusters. It exchanges projected Kubernetes service account tokens for short-lived AWS credentials by calling the EKS Auth API, then serves those credentials to pods via a local credential proxy.
The agent runs as a DaemonSet on each EKS node and exposes a local HTTP endpoint that the AWS SDKs and CLI inside workload pods can use to obtain credentials. The Pod Identity association mapping (which IAM role each service account maps to) is configured in EKS rather than annotated on the service account, which simplifies cross-account access and removes the need for the OIDC provider configuration required by IRSA.