How to: Is there a way to give a pod a separate IAM role that has different permissions than the default instance IAM policy?
This is a third party tool that enables this: https://github.com/jtblin/kube2iam