Resolve IRSA S3 Access

My EKS-based application is running in a Development cluster and currently throws 403 errors whenever the pods attempt to reach our S3 bucket. The root cause is clear: the Kubernetes service account has never been configured for IAM Roles for Service Accounts (IRSA). I need someone to walk through the entire IRSA setup, make the changes, and prove that the pods can finally read and write to S3 without hard-coded credentials.

Scope of work
• Discover the AWS account ID with AWS CLI.
• Draft and apply the trust relationship JSON that lets the service account assume a new IAM role.
• Create that IAM role, then craft a least-privilege S3 access policy and attach it.
• Annotate the existing Kubernetes service account so it references the role.
• Validate the annotation, restart the deployment, and demonstrate that the pods can list objects in the specified bucket (a simple aws s3 ls is enough).

Acceptance criteria
1. kubectl describe serviceaccount <name> shows the correct eks.amazonaws.com/role-arn annotation.
2. kubectl get pods returns all pods in Running state after restart.
3. An exec into a pod followed by an AWS CLI command against the bucket succeeds with HTTP 200 and no 403.

I work exclusively with AWS CLI today, so keep your solution and any scripts in that toolset. Please reply with a brief note on similar IRSA or IAM-for-Kubernetes work you have delivered; experience is the single most important selection factor for me.