I have an account (A) with several ECR private repositories, and another account (B) with an EKS cluster where images from those repositories will be used.

I’ve tested that I can pull images using a resource-specific policy on the ECR repo in account A, but I don’t want to have to do that for each repo, and make sure it’s done correctly by others.

I’ve set up IRSA with an OIDC provider, along with a K8S ServiceAccount granting access to the role in account A. When inside a container with that service account attached to its pod, I have the correct IAM permissions and can see the ECR image info via the AWS CLI.

However, the EKS node itself doesn’t seem to be able to pull the image from account A’s ECR repo. When attempting to pull the image from account A, ECR throws a 403.

It seems like the pod isn’t using the ServiceAccount’s annotated role to pull the container, and only making it available for authenticating actions inside the running container.

How can I make the EKS nodes in account B use the correct role from account A when pulling containers from its registry?