Create an IAM policy that defines the required permissions. Attach the policy directly to the IAM role of the EKS nodes.

Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.

Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.

Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role.

Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.