To use AWS IAM roles for service accounts, you need to annotate the service account in question with an IAM role to assume. While trying to figure out how to get this working, I dug into the source code of the SpiceDB operator and found the spec.config.extraServiceAccountAnnotations field, which as far as I can tell isn't documented anywhere. This works perfectly for setting the required annotation on the ServiceAccount, and it would be very useful for this field to be documented.