Amazon Web Services → Microsoft Azure
Azure equivalent of EKS Pod Identity (and IRSA)
EKS Pod Identity (and IAM Roles for Service Accounts) maps to Microsoft Entra Workload ID for AKS.
About EKS Pod Identity (and IRSA)
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Map Kubernetes service accounts to IAM roles so pods get temporary AWS credentials. Pod Identity uses an EKS agent and association API. IAM Roles for Service Accounts (IRSA) uses OIDC federation. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Pod-level cloud identity | Microsoft Entra Workload ID for AKS | Direct match |
Kubernetes(1)
Pod-level cloud identity Direct match
EKS Pod Identity (and IAM Roles for Service Accounts) maps to Microsoft Entra Workload ID for AKS. Both exchange a Kubernetes service account token for short-lived cloud credentials.
- Mechanism. Pod Identity uses an EKS Pod Identity Agent and association API, with no OIDC provider setup per cluster. IRSA and Workload ID both use the cluster's OIDC issuer and a federated credential or trust policy.
- The credentials are AWS STS credentials for an IAM role on AWS, versus Microsoft Entra access tokens for a user-assigned managed identity or app registration on Azure (then authorized with Azure RBAC).
- The older AAD Pod Identity add-on on AKS is deprecated in favor of Workload ID.