#2417 [Housekeeping] Remove the usage of IAMRole and move towards using service account as part of SecurityContext Issue created by pmahindrakar-oss Describe the issue Flyte supports passing the authorization information for the user pods using K8ServiceAccount , IamRole as part of the SecurityContext/Deprecated AuthRole/Deprecated Auth fields. These can be passed by the users at various levels in this order of overrides • execution level • launchplan level • workflow execution config matchable attribute per project domain/ project domain worflow /project domain workflow launchplan level • application default config level as part of the values.yaml IamRole usage was added to flyte which relied on services like KIAM https://github.com/uswitch/kiam Flyte would add annotations to user pods and KIAM like services would make sure the authentication information is available to the PODS to talk to AWS services like S3. The KIAM solution had race condition issues where in if the user pod made a call before the authentication information was available to the pod then it would fail KIAM has been deprecated as AWS now supports IAM roles for Service Accounts which solves such races as it awaits for the authetication information to be ready before the POD itself can be declared ready and hence preventing such issues. With IAM roles for service account, now the users need to just create a service account and annotate it with right IAM role which has permissions for the pods to access the required AWS services. This can be done manually by the user or they can rely on cluster resource manager to create those for them using the IAM role provided in the values.yaml of flyte Other major cloud provider GCP uses similar concept through workload identity where they have mapping between google service account and kubernetes service accounts and have permissions being defined using this mapping https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity and hence avoiding usage of any external service to provide authentication info for the pods. We should move away from using IAM Role from UI and only allow service accounts to be overriden. There might be some cases like map tasks and some plugins which read such annotations but we should explicitly mention in the UX that they should use these roles only for the above purposes and for plain vanilla flow always use service account What if we do not do this? Confusing UX where users try to send IAM Role which don't get used on normal workflows as they are ignored and instead service account is used Related component(s) flyteadmin Are you sure this issue hasn't been raised already? ☑︎ Yes Have you read the Code of Conduct? ☑︎ Yes flyteorg/flyte