Advanced AI Prompt for AWS EKS Service Account (IRSA) Least-Privilege

Act as a Kubernetes Security Engineer. Develop a highly specific IAM policy and an OIDC Trust Relationship designed for an AWS EKS Service Account utilizing IRSA (IAM Roles for Service Accounts). The execution policy must allow the pod to exclusively perform the `kms:Decrypt` action targeting only the specific KMS key [KMS_KEY_ARN]. The Trust Relationship JSON must strictly verify the cluster's OIDC provider [OIDC_PROVIDER_URL] and enforce a `StringEquals` condition ensuring the `sub` (subject) exactly matches `system:serviceaccount:[NAMESPACE]:[SERVICE_ACCOUNT_NAME]`. This guarantees no other service accounts in the cluster can maliciously assume this IAM role.