AWS Credentials for EKS
Published: 2020-07-27 10:06:27

*What you need to know before you can create AWS Kubernetes clusters using the command line*

[eksctl](https://eksctl.io/) is the AWS command line utility allowing you to administer (e.g. setup/teardown) your AWS Kubernetes cluster. This article details how you configure the credentials you need to use the service. This article is useful as this is not detailed on the eksctl [website](https://eksctl.io/) and is non-trivial.

## IAM Overview

Credentials in AWS are managed using [IAM](https://aws.amazon.com/iam/)  -  AWS Identity and Access Management. Broadly speaking, you create [policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_access-management.html) which are granular aggregations of permissions on AWS objects. You associate these with [groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) to which you add [users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html). If a user has been created for programmatic access use, the user will have an [access key id](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) and a secret access key which can be stored on disk for use in conjunction with the [AWS command line](https://aws.amazon.com/cli/) interface. The same mechanism is used by eksctl.

In this article we set up the eksctl account in accordance with the principle of 'least privilege' - the account should have sufficient privileges to execute actions as needed, but no more.

Below we go through the steps in the above process in detail.

## IAM Policy Setup

The eksctl [website](https://eksctl.io/) does not detail the set of IAM privileges needed to run eksctl, and trial and error is not recommended. Guidance can be found in issue 204 below however.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ryzow0wq12z6h8ax6v01.png)

As this is still somewhat complicated (and incomplete) I'm going to make use of this, but simplify the process for you.

First of all pull down [https://github.com/aerospike-examples/kubernetes-aws](https://github.com/aerospike-examples/kubernetes-aws).

``` bash
git clone https://github.com/aerospike-examples/kubernetes-aws
cd kubernetes-aws
```
The policy you need is in *eks.iam.policy.template*. Some permissions however are account specific - you will see this if you look for the text *account-id* in *eks.iam.policy.template* - this needs replacing with your own account id.

Find your account id by logging into the AWS console. Select 'My Account'

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9vzvjpa5h4lexbhztrey.png)

You will see your account id in the next screen. Copy this.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8nvrwt4us6o9x6mrkwkx.png)

From the *kubernetes-aws* project you just cloned, run

``` bash
./make-policy.sh YOUR_ACCOUNT_ID
```
The result will be saved as *eks.iam.policy*.

Copy the contents of *eks.iam.policy* to the clipboard.

Select the IAM Service in the AWS console (Services->IAM) and click 'Policies'

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ktnpjnbpr1f7ijxlwvtk.png)

Next 'Create Policy'. Select 'JSON' rather than 'Visual Editor', remove the JSON you see and replace with the contents of *eks.iam.policy*. Your screen should look like

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/jvr2gayz0sg38rwb9jy4.png)

Now click 'Review Policy'. Give your policy a name e.g. *EKS*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/p04drubj149ma7x9gqc0.png)

Finally click 'Create Policy', bottom right of the above screen.

## IAM Group Setup

In this section we create an IAM group and add the EKS policy to it. 

Select 'Groups', from the left hand IAM menu.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/2armwrcdn6ykawvgqtra.png)

Click 'Create New Group'. Give your group a name e.g. EKS.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/5044o6udwkmfa0ysuf2j.png)

Click 'Next Step'. Search for the policy you created and select.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/1egnlk56iu864fe5g6r6.png)

Click 'Next Step', followed by 'Create Group'. You should see your new group, EKS, appear in the group listing screen.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8gjker6mus3vxr2cn7i0.png)

## Create IAM User

Now we create a user and associate with the EKS group. Select 'Users' from the left hand side menu above.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9hxa6xu39kxdruric8cq.png)

Click 'Add User'. Give your user a name e.g. EKS and check the 'programmatic access' access type.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/qt9df1rhlmavjqppyqk9.png)

Click 'Next: Permissions'. 'Add User To Group' will be selected by default. Check the 'EKS' group.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/w94qhn3upq4lu56119uv.png)

Click 'Next:Tags' followed by 'Next:Review' and finally 'Create User'. You will see the screen below.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/dh2uiguztwfnq439g1r6.png)

Keep this screen in your browser - you will need it for the steps below.

## AWS CLI Credential Setup

We are now in a position to cache our credentials on disk so they can be used by the AWS CLI or eksctl.

You will need the AWS CLI. Installation details may be found at [https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html).

In the environment in which you will be using the AWS CLI / eksctl type *aws configure* and fill in the access key and secret access key which you can obtain from the screen above. You are also required to add in the default AWS region you wish to use. If you are curious, your credentials are stored in *~/.aws/credentials*.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/otjejo7tfahoy4fa5jjn.png)

I have pixelated my keys as a matter of good practice, but I could also have made them visible and deleted the account immediately after taking the screenshot, then recreating the user. The secret key would have been completely different.

Note that you will need to click 'show' to see the secret access key in the screen above. *You are only able to do this once*. You will need to request another key if you do not record what you see for use in the *aws configure* step. Not a big problem, see below.

## Access Key / Secret Key access

IAM makes it easy to rotate keys and manage accounts. Having created your user above you can access via 'Users' in the IAM menu.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/xw6dpy2bfyz4du5m955e.png)

If we select 'EKS' we see

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8mwjrx24k4zltvediy3l.png)

I have tabbed to 'Security Credentials' above.

Note you can make a set of credentials inactive via 'Make Inactive'. You can request a new set via 'Create Access Key'. This will again give you one time access to your secret key. It also supports key rotation.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ccu7wgpj77k7j6eqdgo6.png)

## Conclusion

In this article we showed you how to set up credentials for eksctl in accordance with the best practice of least privilege. In [https://dev.to/aerospike/aerospike-on-eks-aws-k8s-m5b](https://dev.to/aerospike/aerospike-on-eks-aws-k8s-m5b) we make use of this when detailing how to set up an Aerospike cluster on EKS.