Question: How do I manage permissions across namespaces for IAM users in an Amazon EKS cluster?

I want to manage user permissions for my AWS Identity and Access Management (IAM) users across namespaces in my Amazon Elastic Kubernetes Service (Amazon EKS) cluster.

Short descriptionTo manage user permissions across namespaces in an Amazon EKS cluster, you must:Create an IAM role that can be assumed by members of your organization.Create a Kubernetes role-based access control (RBAC) role (Role) and role binding (RoleBinding) (from the Kubernetes website) for your cluster.Map the IAM roles to the RBAC roles and groups using aws-auth ConfigMap.Note: When a cluster is created, only the Amazon Resource Name (ARN) of the IAM user or role that created the cluster is added to the aws-auth ConfigMap. Also, it is only this ARN that has system:masters permissions. This means that only the cluster creator can add more users or roles to the aws-auth ConfigMap.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Create an IAM role that can be assumed by members of your organizationTo give members of your organization access to a namespace, you must create an IAM role that can be assumed by those members.1.    Create a role to delegate permissions to an IAM user.2.    To verify that a user has permission to assume the IAM role from step 1, configure the AWS CLI. Then, run the following command from that user's workstation:$ aws sts assume-role --role-arn arn:aws:iam::yourAccountID:role/yourIAMRoleName --role-session-name abcde{    "Credentials": {        "AccessKeyId": "yourAccessKeyId",        "SecretAccessKey": "yourSecretAccessKey",        "SessionToken": "yourSessionToken",        "Expiration": "2020-01-30T01:57:17Z"    },    "AssumedRoleUser": {        "AssumedRoleId": "yourAssumedRoleId",        "Arn": "arn:aws:iam::yourAccountID:role/yourIAMRoleName"    }}Note: Replace yourAccessKeyId, yourSecretAccessKey, yourSessionToken, yourAssumedRoleId, yourAccountID, and yourIAMRoleName with your values.3.    To configure the IAM user's kubectl to always use the role when accessing the Kubernetes API, run the following command to update the kubeconfig file:$ aws eks update-kubeconfig --name yourClusterName --role-arn arn:aws:iam::yourAccountID:role/yourIAMRoleNameNote: Replace yourClusterName, y****ourAccountID, and yourIAMRoleName with your values.Create a Kubernetes RBAC role and role binding for your clusterImportant: The following steps must be completed from a workstation that's configured to access Kubernetes. The user must be a cluster creator or an IAM entity that already has access through the aws-auth ConfigMap. The IAM role created in previous steps hasn't been given access to the cluster yet.You can bind a cluster role (ClusterRole) to a role binding. This is possible because an RBAC role and role binding are Kubernetes namespaced resources. However, you can't bind a role to a cluster role binding (ClusterRoleBinding).1.    To list all built-in cluster roles and bind the cluster role admin to a role binding for that namespace, run the following command:$ kubectl get clusterrole2.    To see the permissions associated with the cluster role admin, run the following command:$ kubectl describe clusterrole adminImportant: To use an existing namespace, you can skip the following step 3. If you choose a different name for the namespace test, replace the values for the namespace parameter in the following steps 4 and 6.3.    To create the namespace test that grants access to the IAM users as part of the IAM group, run the following command:$ kubectl create namespace test4.    To create a Kubernetes RBAC role, copy the following code into a new YAML file (for example, role.yaml):kind: RoleapiVersion: rbac.authorization.k8s.io/v1beta1metadata:  name: k8s-test-role  namespace: testrules:  - apiGroups:      - ""      - "apps"      - "batch"      - "extensions"    resources:      - "configmaps"      - "cronjobs"      - "deployments"      - "events"      - "ingresses"      - "jobs"      - "pods"      - "pods/attach"      - "pods/exec"      - "pods/log"      - "pods/portforward"      - "secrets"      - "services"    verbs:      - "create"      - "delete"      - "describe"      - "get"      - "list"      - "patch"      - "update"Note: The preceding role allows users to perform all the actions in the verbs section.5.    To create the RBAC role, run the following command:$ kubectl apply -f role.yaml6.    To create a Kubernetes role binding, copy the following code into a new YAML file (for example, rolebinding.yaml):kind: RoleBindingapiVersion: rbac.authorization.k8s.io/v1beta1metadata:  name: k8s-test-rolebinding  namespace: testsubjects:- kind: User  name: k8s-test-userroleRef:  kind: Role  name: k8s-test-role  apiGroup: rbac.authorization.k8s.ioNote: The role binding is a namespaced resource that binds the RBAC role in the roleRef section to the user in the subjects section. You don't need to create the user k8s-test-user, because Kubernetes doesn't have a resource type user.7.    To create the RBAC role binding, run the following command:$ kubectl apply -f rolebinding.yamlMap the IAM role to the RBAC role and group using the aws-auth ConfigMAP1.    To associate the IAM role yourIAMRoleName with the Kubernetes user k8s-test-user, run the following command:$ eksctl create iamidentitymapping --cluster yourClusterName --arn arn:aws:iam::yourAccountID:role/yourIAMRoleName --username k8s-test-userNote: Replace yourClusterName, yourAccountID, and yourIAMRoleName with your values.Test the access to the namespace1.    To test access to the namespace test, assume the IAM role yourIAMRoleName for a user that you created, and then run the following command:$ kubectl create job hello -n test --image=busybox -- echo "Hello World"Note: The preceding command creates a job by using the RBAC role k8s-test-role that you created earlier.2.    To check the pod and job in the namespace test, run the following commands:$ kubectl get job -n testNAME    COMPLETIONS   DURATION   AGEhello   1/1           4s         15s$ kubectl get pods -n testNAME          READY   STATUS      RESTARTS   AGEhello-tpjmf   0/1     Completed   0          2m34sThe IAM users that are part of the IAM group can now use this namespace and deploy their applications.

Related informationEnabling IAM user and role access to your cluster