feat(eks): add targetRoleArn support for EKS Pod Identity associations

[pahud]

Issue # (if applicable)

Closes #35219

Reason for this change

EKS Pod Identity supports a targetRoleArn parameter that enables role chaining scenarios, particularly for cross-account access patterns. This feature was missing from the CDK construct, limiting users who need to access AWS resources in different accounts or implement complex role assumption chains.

Description of changes

Core Implementation:

• Previously, the options for a ServiceAccount were spread across multiple interface declarations, which was likely an oversight. This pull request consolidates them into a single, coherent interface and adds the new targetRole property.
• Updated the Pod Identity association creation logic in ServiceAccount construct to include targetRole when specified
• The implementation extracts the role ARN from the IRole object and passes it to the AWS::EKS::PodIdentityAssociation CloudFormation resource

Design Decisions:

• Made targetRole optional to maintain backward compatibility
• Used iam.IRole interface for better type safety and consistency with CDK patterns
• Allows both imported roles (via Role.fromRoleArn()) and newly created roles
• Maintained existing behavior when targetRole is not specified

Alternatives Considered:

• Using raw ARN string: Rejected in favor of type-safe IRole interface for better developer experience
• Adding separate method for target role associations: Rejected to keep API simple and consistent

Describe any new or updated permissions being added

No new CDK permissions are required. The feature uses existing EKS Pod Identity functionality.

When users specify a targetRole, they need to ensure:

• The target role trusts the service account role (configured by the user)
• The service account role has permission to assume the target role (handled automatically by EKS)

Description of how you validated changes

Unit Tests:

• Added comprehensive tests in service-account.test.ts covering:
  • Basic targetRole functionality with both created and imported roles
  • CloudFormation template generation with targetRole
  • Backward compatibility (no targetRole specified)
  • Integration with different identity types
  • Type safety validation

Integration Tests:

• Created integ.eks-pod-identity-target-role.ts that:
  • Deploys actual EKS cluster with Pod Identity association using targetRole
  • Validates CloudFormation resource creation
  • Calls EKS API to verify targetRoleArn is correctly set and returned
  • Confirms end-to-end functionality

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license