I don't see a serviceAccount under runner spec for https://github.com/cloudposse/terraform-aws-components/blob/main/modules/eks/github-actions-runner. Would that not be how you'd associate IAM permission to the runner scale set?

do you mean how to assign IAM permission to the runners in GitHub?

Yes, I was expecting to do it with Service Roles (IRSA) but is there a different approach?

Yes entirely. We use GitHub OIDC https://docs.cloudposse.com/layers/github-actions/github-oidc-with-aws/

Got it, thank you!