Advanced AI Prompt for Implementing IRSA and IAM Security for EKS

Act as a DevSecOps Expert. Define a secure implementation of IAM Roles for Service Accounts (IRSA) for a workload running in [NAMESPACE] named [SERVICE_ACCOUNT_NAME]. The goal is to grant least-privilege access to [AWS_SERVICE_ARN]. Generate the Terraform code for the IAM OIDC provider association, the IAM Role with a trust policy strictly limited to the OIDC provider, and the Kubernetes ServiceAccount manifest with the appropriate annotations. Ensure you incorporate the [PERMISSION_BOUNDARY] to restrict the role's scope. Explain how this setup prevents credential leakage compared to node-level IAM roles.