{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "IAM role for serviceaccount \"default/sa-1\" [created and managed by eksctl]",
    "Resources": {
        "Role1": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRoleWithWebIdentity"
                            ],
                            "Condition": {
                                "StringEquals": {
                                    "oidc.eks.us-west-2.amazonaws.com/id/A39A2842863C47208955D753DE205E6E:aud": "sts.amazonaws.com",
                                    "oidc.eks.us-west-2.amazonaws.com/id/A39A2842863C47208955D753DE205E6E:sub": "system:serviceaccount:default:sa-1"
                                }
                            },
                            "Effect": "Allow",
                            "Principal": {
                                "Federated": "arn:aws:iam::456123987123:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/A39A2842863C47208955D753DE205E6E"
                            }
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
                ]
            }
        }
    },
    "Outputs": {
        "Role1": {
            "Value": {
                "Fn::GetAtt": "Role1.Arn"
            }
        }
    }
}
