EKS Roles and Access Privileges

User credentials and AssumeRole (if applicable) must be configured with a minimum set of privileges. The user/role must be specified in the aws-auth.yaml config map. The aws-auth.yaml config map can be edited using the following command.

$ kubectl edit configmap -n kube-system aws-auth

If AssumeRole is not used, the user must be added to the “mapUsers” section of the aws-auth.yaml config map with appropriate group. If AssumeRole ARN is specified, the role must be added to the “mapRoles” section of the aws-auth.yaml config map. A sample aws-auth.yaml config map with AssumeRole is provided below.

    apiVersion: v1
    data:
      mapAccounts: |
        []
      mapRoles: |
        - "groups":
          - "system:bootstrappers"
          - "system:nodes"
          "rolearn": "arn:aws:iam::938996165657:role/eks-cluster-2021011418144523470000000a"
          "username": "system:node:{{EC2PrivateDNSName}}"
        - "rolearn": arn:aws:iam::938996165657:role/BasicPrivilegesRole
          "username": secure.workload.read.only-user
          "groups":
            - secure.workload.read.only

      mapUsers: |
        []
    kind: ConfigMap
    metadata:
      creationTimestamp: "2021-01-14T18:14:47Z"
      managedFields:
      - apiVersion: v1
        fieldsType: FieldsV1
        fieldsV1:
          f:data:
            .: {}
            f:mapAccounts: {}
            f:mapRoles: {}
            f:mapUsers: {}
        manager: HashiCorp
        operation: Update
        time: "2021-01-14T18:14:47Z"
      name: aws-auth
      namespace: kube-system
      resourceVersion: "829"
      selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
      uid: 6c5a3ac7-58c7-4c57-a9c9-cad701110569