Amazon Web Services

Cloud Providers

In this article, we'll explore how we can use an AWS IAM user and grant it permissions inside a k8s cluster on AWS EKS. I'll assume you have an EKS cluster already created.

In AWS EKS, the IAM user used to create AWS EKS is the default k8s admin user and we can also declare other new users/roles via aws-auth ConfigMap.

Adding new users in AWS EKS has two parts

RBAC (Role-Based Access Management on Kubernetes)

One with administrator permission for management - k8sadmin

One to manage only deployments/replicasets/pods to a particular namespace

We can grant IAM users K8s permissions without attaching any AWS permission. Here's how.

This IAM user will not need AWS console access, but programmatic access will be necessary. No need to set any permissions for AWS account and tags. Let's create the 

 user and save the credentials(AWS access and secrets key) and IAM arn, we'll need them soon.

 group. That group gives admin rights on the k8s cluster to the new IAM user.

 command and configure the IAM user credentials for the key and secret key.

4. Export the environmental varaible AWS_DEFAULT_PROFILE to the new IAM user with the following command: 

 user has admin rights with the following kubectl commands. If all the kubectl commands return real data, our k8s is using the new user.

Now we have an IAM user with no permissions in our AWS account, but with admin rights in our Kubernetes cluster

Our administrative rights are ready to go, but we need to establish our user which only has deployment permissions in the 

 administrative user to create this limited user.

We will use the reference from the below article to create the k8s role and role-binding.

Bitmani Configure RBAC in your Kubernetes Cluster

1. Create the role for managing deployments in a new file called 

. In this role YAML, we are adding the rules that allow a user to execute several operations(get/list/watch/create/update/patch/delete) on Deployments, Pods, and ReplicaSets.

3. Bind the role to the developer user by creating this file: 

4. Create the above role-binding with kubectl:

 in the AWS console (as above, only programmatic access, no AWS account permissions, no tags, save credentials, and IAM arn)

kubectl edit configmap aws-auth -n kube-system

) and add a new user mapping for the developer IAM user, but this time mapped to the 

 IAM user permission, we need to create the aws profile for the developer IAM user and configure the AWS key and secrets key and export the new profile.

Now let's test out the developer k8s user permissions by trying to do something we shouldn't be able to

And we're blocked - perfect, this is the expected output.

Now lets do something we should be able to do, deploy Nginx in the 

In this article, we covered how to create an AWS IAM user with no AWS permissions. We then granted that IAM user administrative permissions within our AWS EKS cluster, and connected together with the IAM access key and secret.

 user which our Dev team (or CI/CD!) can use to deploy their application. We tested to make sure this user didn't have any additional rights.

Sudhanshu Dev

Followed Topics

Published Articles

Controlling AWS EKS Access Using AWS IAM And Kubernetes RBAC

Published Policies

Sudhanshu Dev

Followed Topics

Published Articles

Controlling AWS EKS Access Using AWS IAM And Kubernetes RBAC

Published Policies

Get the IAM Pulse Check Newsletter