diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md
index 1e934e2c..2193de3a 100644
--- a/nullplatform/base/README.md
+++ b/nullplatform/base/README.md
@@ -126,6 +126,7 @@ resource "example_resource" "this" {
 | <a name="input_cloudwatch_enabled"></a> [cloudwatch\_enabled](#input\_cloudwatch\_enabled) | Enable CloudWatch (global switch). | `bool` | `false` | no |
 | <a name="input_cloudwatch_logs_enabled"></a> [cloudwatch\_logs\_enabled](#input\_cloudwatch\_logs\_enabled) | Enable log forwarding to CloudWatch. | `bool` | `false` | no |
 | <a name="input_cloudwatch_performance_metrics_enabled"></a> [cloudwatch\_performance\_metrics\_enabled](#input\_cloudwatch\_performance\_metrics\_enabled) | Enable performance metrics in CloudWatch. | `bool` | `false` | no |
+| <a name="input_cloudwatch_service_account_annotations"></a> [cloudwatch\_service\_account\_annotations](#input\_cloudwatch\_service\_account\_annotations) | Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch\_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role. | `map(string)` | `{}` | no |
 | <a name="input_control_plane_enabled"></a> [control\_plane\_enabled](#input\_control\_plane\_enabled) | Enable the control plane. | `bool` | `false` | no |
 | <a name="input_datadog_api_key"></a> [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key. | `string` | `""` | no |
 | <a name="input_datadog_enabled"></a> [datadog\_enabled](#input\_datadog\_enabled) | Enable Datadog integration. | `bool` | `false` | no |
@@ -482,6 +483,11 @@ resource "example_resource" "this" {
       "description": "Enable access logs in CloudWatch.",
       "required": false
     },
+    {
+      "name": "cloudwatch_service_account_annotations",
+      "description": "Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role.",
+      "required": false
+    },
     {
       "name": "metrics_server_enabled",
       "description": "Enable the metrics server.",
diff --git a/nullplatform/base/locals.tf b/nullplatform/base/locals.tf
index 1c1715d3..74ccbf7f 100644
--- a/nullplatform/base/locals.tf
+++ b/nullplatform/base/locals.tf
@@ -98,11 +98,12 @@ locals {
       newrelic_region          = var.newrelic_region
 
       # ---- cloudwatch ----
-      cloudwatch_enabled                    = var.cloudwatch_enabled ? "true" : "false"
-      cloudwatch_logs_enabled               = var.cloudwatch_logs_enabled ? "true" : "false"
-      cloudwatch_performancemetrics_enabled = var.cloudwatch_performance_metrics_enabled ? "true" : "false"
-      cloudwatch_custommetrics_enabled      = var.cloudwatch_custom_metrics_enabled ? "true" : "false"
-      cloudwatch_accesslogs_enabled         = var.cloudwatch_access_logs_enabled ? "true" : "false"
+      cloudwatch_enabled                     = var.cloudwatch_enabled ? "true" : "false"
+      cloudwatch_logs_enabled                = var.cloudwatch_logs_enabled ? "true" : "false"
+      cloudwatch_performancemetrics_enabled  = var.cloudwatch_performance_metrics_enabled ? "true" : "false"
+      cloudwatch_custommetrics_enabled       = var.cloudwatch_custom_metrics_enabled ? "true" : "false"
+      cloudwatch_accesslogs_enabled          = var.cloudwatch_access_logs_enabled ? "true" : "false"
+      cloudwatch_service_account_annotations = var.cloudwatch_service_account_annotations
 
       # ---- metrics server ----
       metricsserver_enabled = var.metrics_server_enabled ? "true" : "false"
diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml
index a2d7aeb4..310f768e 100644
--- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml
+++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml
@@ -150,6 +150,13 @@ cloudwatch:
     enabled: ${cloudwatch_custommetrics_enabled}
   accessLogs:
     enabled: ${cloudwatch_accesslogs_enabled}
+%{ if cloudwatch_enabled == "true" && length(cloudwatch_service_account_annotations) > 0 ~}
+  serviceAccount:
+    annotations:
+%{ for key, value in cloudwatch_service_account_annotations ~}
+      ${key}: "${value}"
+%{ endfor ~}
+%{ endif ~}
 # Metrics server configuration
 metricsServer:
   enabled: ${metricsserver_enabled}
diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf
index 746f6e1a..99293276 100644
--- a/nullplatform/base/variables.tf
+++ b/nullplatform/base/variables.tf
@@ -365,6 +365,12 @@ variable "cloudwatch_access_logs_enabled" {
   default     = false
 }
 
+variable "cloudwatch_service_account_annotations" {
+  type        = map(string)
+  description = "Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role."
+  default     = {}
+}
+
 ############################################
 # Metrics Server
 ############################################