kiam-test.yml

---
apiVersion: v1
kind: Namespace
metadata:
  name: kiam-test
  annotations:
    iam.amazonaws.com/permitted: ".*"
---
apiVersion: v1
kind: Pod
metadata:
  name: kiam-tester
  namespace: kiam-test
  annotations:
    iam.amazonaws.com/role: kiam-app-test
spec:
  containers:
  - name: kiam-tester
    image: garland/aws-cli-docker:latest
    command:
      - /bin/sleep
    args:
      - "3600"
    env:
      - name: AWS_DEFAULT_REGION
        value: eu-west-1

Run aws sts get-caller-identity to see if pod is getting the desired role

kubectl exec -it kiam-tester -- aws sts get-caller-identity