// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-deploying-application/cloud-experts-deploying-application-integrating-aws.adoc

:_mod-docs-content-type: PROCEDURE
[id="cloud-experts-deploying-application-integrating-aws-create-service-pod_{context}"]
= Creating the service account for your pod

[role="_abstract"]
Create your new service account that you use on your pod.

.Procedure
. Get the ARN for the AWS IAM role we created so that it will be included as an annotation when you create your service account by running the following command:
+
[source,terminal]
----
$ export APP_IAM_ROLE_ARN=$(aws iam get-role --role-name=ostoy-sa-role --query Role.Arn --output text)
----
+
. Create the service account by running the following command:
+
[source,terminal]
----
$ cat <<EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ostoy-sa
  namespace: ${OSTOY_NAMESPACE}
  annotations:
    eks.amazonaws.com/role-arn: "$APP_IAM_ROLE_ARN"
EOF
----
+
[IMPORTANT]
====
Do not change the name of the service account from "ostoy-sa" or you will have to change the trust relationship for the AWS IAM role.
====
+
. Grant the service account the `restricted` role by running the following command:
+
[source,terminal]
----
$ oc adm policy add-scc-to-user restricted system:serviceaccount:${OSTOY_NAMESPACE}:ostoy-sa
----
+
. Confirm that the annotation was successful by running the following command:
+
[source,terminal]
----
$ oc describe serviceaccount ostoy-sa -n ${OSTOY_NAMESPACE}
----
+
**Example output**
+
[source,terminal]
----
Name:                ostoy-sa
Namespace:           ostoy
Labels:              <none>
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::000000000000:role/ostoy-sa-role
Image pull secrets:  ostoy-sa-dockercfg-b2l94
Mountable secrets:   ostoy-sa-dockercfg-b2l94
Tokens:              ostoy-sa-token-jlc6d
Events:              <none>
----