The Badge Machine - IRSA end to end

Six steps a pod’s request takes to reach a bucket in another AWS account, and the four places along that path where a mismatch shows up as a different error.

prerequisite: The Two Planes - why AWS feels like 100 random things · token detail: OIDC - the Passport & the Stamp-Book

Before you start. An AWS account is one company’s or team’s walled section of AWS, with its own bill and identities. A container is one program sealed with everything it needs. A pod is one running container that the cluster, a group of machines run as one by Kubernetes, promises to keep running; a namespace is a fenced area of that cluster with its own name. The Two Planes - why AWS feels like 100 random things asked two questions of every failed request, can it reach the service and is its identity allowed, and this one lives in the second. If a signed token is new, Authentication in Security shows one in one read.