Microsoft Azure → Amazon Web Services
AWS equivalent of Microsoft Entra Workload ID for AKS
The closest AWS equivalent of Microsoft Entra Workload ID for AKS is EKS Pod Identity (and IRSA).
About Microsoft Entra Workload ID for AKS
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Federates Kubernetes service account tokens (OIDC issuer) with Microsoft Entra managed identities or app registrations, so pods get Entra tokens without secrets. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Pod-level cloud identity | EKS Pod Identity (and IRSA) | Direct match |
Kubernetes(1)
Pod-level cloud identity Direct match
EKS Pod Identity (and IAM Roles for Service Accounts) maps to Microsoft Entra Workload ID for AKS. Both exchange a Kubernetes service account token for short-lived cloud credentials.
- Mechanism. Pod Identity uses an EKS Pod Identity Agent and association API, with no OIDC provider setup per cluster. IRSA and Workload ID both use the cluster's OIDC issuer and a federated credential or trust policy.
- The credentials are AWS STS credentials for an IAM role on AWS, versus Microsoft Entra access tokens for a user-assigned managed identity or app registration on Azure (then authorized with Azure RBAC).
- The older AAD Pod Identity add-on on AKS is deprecated in favor of Workload ID.