[EKS] [IAM]: Pods running on EKS should not have access to underlying IAM Node roles by default

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

According to this document, pods have all permissions assigned to the service account and node IAM Role.
https://docs.aws.amazon.com/eks/latest/userguide/restrict-ec2-credential-access.

Furthermore the solution proposed in the documentation, using iptable rules to block access is not a tenable solution in any environment that actually wants to use IRSA. The alternative, using something like calico is really not a great solution either, as the cluster is not secure by default.

By default, all clusters not using IRSA, or using IRSA and have not defined a role for the services account attached to a pod should grant DENY ALL.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Clusters should be secure by default.

Start with the EKS credential-access document linked in the issue and compare the current node IAM role and IRSA behavior. Define completion as pods being denied access to underlying node roles by default while explicitly configured IRSA access remains usable; the issue names no repository files or tests.

Written by the indexing model from the issue text.