Amazon EKS — IAM Setup

IAM Setup for EKS

Proper IAM configuration is the foundation of EKS security. This page shows you how to set up IAM users and roles with the right permissions for creating and managing EKS clusters.

---

Why IAM Matters for EKS

EKS uses IAM for two separate things:

IAM in EKS — Two Separate Concerns
┌─────────────────────────────────────────────┐
│                                             │
│  1. AWS API Authentication                  │
│     Who can CREATE/DELETE EKS clusters?     │
│     Who can manage node groups?             │
│     → Controlled by IAM policies            │
│                                             │
│  2. Kubernetes API Authentication            │
│     Who can kubectl into the cluster?       │
│     Who can deploy pods?                    │
│     → Controlled by aws-auth / access       │
│       entries (maps IAM → K8s RBAC)         │
│                                             │
└─────────────────────────────────────────────┘

---

Option 1: IAM User (For Learning)

For this tutorial, create a dedicated IAM user:

Create the IAM User

$ aws iam create-user --user-name eks-admin
{
    "User": {
        "UserName": "eks-admin",
        "UserId": "AIDAEXAMPLE",
        "Arn": "arn:aws:iam::123456789012:user/eks-admin"
    }
}

Attach Admin Policy (For Tutorial Only)

$ aws iam attach-user-policy \
    --user-name eks-admin \
    --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

⚠️ Warning: AdministratorAccess gives full AWS access. This is fine for a tutorial but never use this in production. We’ll cover least-privilege IAM in Chapter 9 — IAM & Security.

Create Access Keys

$ aws iam create-access-key --user-name eks-admin
{
    "AccessKey": {
        "UserName": "eks-admin",
        "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    }
}

Configure AWS CLI

$ aws configure --profile eks-tutorial
AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name: us-east-1
Default output format: json

$ export AWS_PROFILE=eks-tutorial

---

Option 2: IAM Role (Recommended for Production)

Using IAM roles is more secure than long-lived access keys:

Create the Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Save this as trust-policy.json.

Create the Role

$ aws iam create-role \
    --role-name EKSAdminRole \
    --assume-role-policy-document file://trust-policy.json

$ aws iam attach-role-policy \
    --role-name EKSAdminRole \
    --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Assume the Role

$ aws sts assume-role \
    --role-arn arn:aws:iam::123456789012:role/EKSAdminRole \
    --role-session-name eks-session

---

Minimum IAM Permissions for EKS

If you can’t use AdministratorAccess, here are the minimum permissions needed:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:*",
                "ec2:*",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PassRole",
                "iam:GetRole",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:GetInstanceProfile",
                "iam:CreateOpenIDConnectProvider",
                "iam:DeleteOpenIDConnectProvider",
                "iam:GetOpenIDConnectProvider",
                "iam:TagOpenIDConnectProvider",
                "cloudformation:*",
                "autoscaling:*",
                "elasticloadbalancing:*",
                "ssm:GetParameter",
                "logs:*",
                "sts:GetCallerIdentity"
            ],
            "Resource": "*"
        }
    ]
}

---

Common Mistakes

Mistake	Impact
Using root account	Security risk — create an IAM user instead
Long-lived access keys in production	Use IAM roles with temporary credentials
Too-broad permissions	Start with AdministratorAccess for learning, then restrict
Forgetting to set AWS_PROFILE	Commands run against wrong account
Same IAM user for dev and prod	Use separate accounts/roles for isolation

---

Quick Reference

# Create IAM user
$ aws iam create-user --user-name eks-admin
$ aws iam attach-user-policy --user-name eks-admin \
    --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
$ aws iam create-access-key --user-name eks-admin

# Configure profile
$ aws configure --profile eks-tutorial
$ export AWS_PROFILE=eks-tutorial

# Verify
$ aws sts get-caller-identity

---

What’s Next?

Let’s make sure everything works: Verify Tools.