AWS EKS pod-identity-association
The association is a two-sided thing — the AWS side links (namespace, serviceAccount) → IAM role, and the Kubernetes side is just which SA a pod runs as. There's no direct kubectl resource that shows the combined picture, but here's