How to build a configuration to enable IAM roles for service accounts (IRSA)

irsa.go

import (
    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/credentials"
    "github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
    "github.com/aws/aws-sdk-go/aws/credentials/stscreds"
    "github.com/aws/aws-sdk-go/aws/ec2metadata"
    "github.com/aws/aws-sdk-go/aws/session"
)

func buildConfig() {
    sess := session.Must(session.NewSession())
    aws.NewConfig().
        WithCredentialsChainVerboseErrors(true).
        WithCredentials(credentials.NewChainCredentials([]credentials.Provider{
            &credentials.EnvProvider{},
            &credentials.SharedCredentialsProvider{},
            // Required for IRSA
            stscreds.NewWebIdentityRoleProvider(
                sts.New(sess),
                os.Getenv("AWS_ROLE_ARN"),
                "",
                os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE"),
            ),
            &ec2rolecreds.EC2RoleProvider{
                Client: ec2metadata.New(sess),
            },
        }))

thanks, very useful!

Updating newer version, it would be:

aws.NewConfig().
WithCredentialsChainVerboseErrors(true).
WithCredentials(credentials.NewChainCredentials([]credentials.Provider{
    &credentials.EnvProvider{},
    &credentials.SharedCredentialsProvider{},
    // Required for IRSA
    stscreds.NewWebIdentityRoleProviderWithOptions(
        sts.New(sess),
        os.Getenv("AWS_ROLE_ARN"),
        "",
        stscreds.FetchTokenPath(os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")),
    ),
    &ec2rolecreds.EC2RoleProvider{
        Client: ec2metadata.New(sess),
    },
}))