Advanced AI Prompt for Implementing IRSA and IAM Security for EKS

Act as a DevSecOps Expert. Architect a secure implementation of IAM Roles for Service Accounts (IRSA) targeting a microservice running within the [NAMESPACE] namespace utilizing the [SERVICE_ACCOUNT_NAME]. The absolute mandate is to grant zero-trust, least-privilege access exclusively to the [AWS_SERVICE_ARN]. Output the complete Terraform HCL establishing the IAM OIDC provider association, and the specific AWS IAM Role featuring an `AssumeRoleWithWebIdentity` trust policy strictly scoped via `StringEquals` to the specific OIDC audience and service account. Apply the [PERMISSION_BOUNDARY] policy ARN to cap maximum privileges. Conclude with the corresponding Kubernetes ServiceAccount YAML manifest featuring the `eks.amazonaws.com/role-arn` annotation, explaining how this physically prevents lateral credential leakage.