What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
Yes It does more than just creating a service account. It does three things:

It Creates an IAM role.
It attaches the desired iam-policy (--attach-policy-arn
&lt;POLICY_ARN&gt;) to the created IAM role.
It creates a new kubernetes service account annotated with the arn of the created IAM role.

Now It's easy to declare the above steps using kubernetes and aws providers in terraform.