How do I allow an additional AWS user to gain access to EKS?

Question

I'm trying to do:

[ec2-user@xxxxxxxxx x]$ aws eks update-kubeconfig --name prod-eks-v2 --role-arn arn:aws:iam::9xxxxxxxxxxeks-v2-cluster-ServiceRole-xxxxxxxxxx

An error occurred (AccessDeniedException) when calling the DescribeCluster operation: User: arn:aws:iam::xxxxxxxxxxx:user/ecr is not authorized to perform: eks:DescribeCluster on resource: arn:aws:eks:eu-west-1:xxxxxxxxxxxxxxx:cluster/prod-eks-v2

This is for an additional user I've added. I've already added them to the aws-auth configmap by adding the following:

  mapUsers: |
    - userarn: arn:aws:iam::xxxxxxxxxxxx:user/xxxxxxxxx
    username: admin
    groups:
        - system:masters

Trying to assume the role manually:

aws sts assume-role --role-arn arn:aws:iam::xxxxxxxx:role/eksctl-prod-eks-v2-cluster-ServiceRole-xxxx --role-session-name test-eks-role

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::xxxxxxxxxx:user/ecr is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxxxxxxxx:role/eksctl-prod-eks-v2-cluster-ServiceRole-xxxxxxxxxxxxxx

This is the trust relationship json for the cluster-ServiceRole...:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

How can I resolve this? I followed the docs from https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/

Update:

I modified the trust relationship to now be:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com",
        "AWS": "arn:aws:iam::xxxxxxx:user/xxxxxx"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

And can successfully do:

aws sts assume-role --role-arn arn:aws:iam::xxxxxxxxxx:role/eksctl-prod-eks-v2-cluster-ServiceRole-OCH0HY9R9WGS --role-session-name test-eks-role

But I still get the ...is not authorized to perform: eks:DescribeCluster on resourc... when doing aws eks update-kubeconfig --name prod-eks-v2.

Update 2:

I added the user to the AmazonEKSWorkerNodePolicy role which now allows me to generate the config successfully with aws eks update-kubeconfig... However I get a error: You must be logged in to the server (Unauthorized) when attempting anything via kubectl....

The bottom of the kubeconfig file looks like:

users:
- name: arn:aws:eks:eu-west-1:xxxxxxxxxxxx:cluster/prod-eks-v2
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - -i
      - prod-eks-v2
      - -r
      - arn:aws:iam::xxxxxx:role/eksctl-prod-eks-v2-cluster-ServiceRole-xxxxxxxxxx
      command: aws-iam-authenticator

Update 3:

Super confused... I can manually generate token and verify it with:

aws-iam-authenticator token -i prod-eks-v2 -r...
aws-iam-authenticator verify -t ...

But as mentioned doing anything with kubectl shows error: You must be logged in to the server (Unauthorized)...

doing kubectl get pods -v=10: shows:

...
I1115 12:36:42.163298   10509 request.go:942] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
...

How do I allow an additional AWS user to gain access to EKS?

0 Answers0