Newer version of the Amazon SDK is needed for Kubernetes Pods running in AWS EKS:
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
This allows for fine-grained Pod access to ECR.
+1 to this. Would be a great quality of life and security improvement for Drone in Kubernetes.
According to the AWS docs for minimum SDK versions, the aws-sdk-go module needs to be updated to version 1.23.13 or above to support IAM roles for Kubernetes service accounts (IRSA for short).
Current SDK version requires that we either use something like KIAM (good but not ideal) or create an IAM user with long-lived keys (definitely not ideal) to grant AWS API access.
It looks like we have an open pull request to upgrade the aws package. I will work on getting that merged today.