Question regarding AWS LAB envoiroment and POD Identeties

igi · May 3, 2026, 7:41am

Hello, in the AWS lab enviroment i have tried creating some EKS resources with terraform, and most of it works fine, even the IRSA system works with various resources. However, when i try using pod identety with terrafrom im able to install the addon but the role association is giving me 403 error. I suspect this is limited due to the lab constraints and how the AWS LAB was designed ?

 Error: creating EKS Pod Identity Association
│
│   with aws_eks_pod_identity_association.alb_controller,
│   on pod-identity-roles.tf line 66, in resource "aws_eks_pod_identity_association" "alb_controller":
│   66: resource "aws_eks_pod_identity_association" "alb_controller" {
│
│ operation error EKS: CreatePodIdentityAssociation, https response error StatusCode: 403, RequestID: 4753bec5-f12c-4ecf-93a9-7e4568ac9654, api error
│ AccessDeniedException: User: arn:aws:iam::637423283722:user/kk_labs_user_938814 is not authorized to perform: eks:CreatePodIdentityAssociation on resource:
│ arn:aws:eks:us-east-1:637423283722:cluster/demo-eks because no identity-based policy allows the eks:CreatePodIdentityAssociation action
╵
╷
│ Error: creating EKS Pod Identity Association
│
│   with aws_eks_pod_identity_association.backup_job,
│   on pod-identity-roles.tf line 110, in resource "aws_eks_pod_identity_association" "backup_job":
│  110: resource "aws_eks_pod_identity_association" "backup_job" {
│
│ operation error EKS: CreatePodIdentityAssociation, https response error StatusCode: 403, RequestID: 6011f24b-a801-4388-aba9-1d6a959c87c1, api error
│ AccessDeniedException: User: arn:aws:iam::637423283722:user/kk_labs_user_938814 is not authorized to perform: eks:CreatePodIdentityAssociation on resource:
│ arn:aws:eks:us-east-1:637423283722:cluster/demo-eks because no identity-based policy allows the eks:CreatePodIdentityAssociation action

raymond.baoly · May 4, 2026, 3:25am

Hi @igi

Could you please share the lab link or KKE level course and task name?

igi · May 4, 2026, 5:08am

@raymond.baoly Yes, of course. Its AWS Playground
https://kodekloud.com/cloud-playgrounds/aws
my bad i should have been more specific

raymond.baoly · May 4, 2026, 6:11am

Hi @igi

I don’t think the playground supports pod identity permissions because there are some limitations with Cloud IAM. You can check the documentation below for more details:

github.com

kodekloudhub/community-faq/blob/main/docs/playgrounds.md#cloud-iam

# Playground mini-FAQ

KodeKloud playgrounds are available to PRO subscribers and allow you to try things out in sandboxed playgrounds at no additional cost.

* [Why can't I?](#why-cant-i)
* [Cloud IAM](#cloud-iam)
    * [AWS IAM](#aws-iam)
* [Kubernetes Clusters](#kubernetes-clusters)
* [How do I browse my service?](#how-do-i-browse-my-service)

## Why can't I?

The majority of questions we handle on the forums are questions like "*Why can't I do X on this playground?*", normally in relation to the cloud playgrounds. These playgrounds have *limited* functionality and *restricted* access, i.e. it's not like you signed up for your own cloud account where you have full admin rights to do anything. There is of course nothing to stop you from signing up for your own cloud accounts - they are all free to sign up to, but you personally pay for any resources created which can get expensive quickly, especially if you forget to delete resources you created or you leave a door open and a hacker starts a bitcoin mining operation on your account! Our sandboxes, while limited, protect you from nasty surprises!

There are 3 main reasons

1. **Cost**. Many services are expensive to run. Also various configurations of services you are allowed to run like AWS EC2 where it's possible without constraints to launch a single instance that costs over 200 US dollars an hour! If we did not limit what can be done on a cost basis, the subscription price for PRO membership would have to be significantly increased!
1. **Security**. We need to protect against privilege escalations, e.g. ability to create new users with more permissions than the user you log in as, and unacceptable use of resources. Hence the IAM is quite tightly locked down. Tighter control on IAM also enforces the cost control described above, preventing users from launching costly resources.
1. **Manageability**. Adding a service that isn't currently offered in the playground is not a simple case of "just switch it on". We maintain a pool of cloud provider accounts which are recycled at the end of every session. For each supported service, there is a lot of work involved in:
    * Planning what parts of that service can be enabled from a cost point of view.

This file has been truncated. show original