AWS EKS: Fine-Grained IAM Roles for Service Accounts (IRSA)