Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

User cannot view AWS EKS Console after setup EKS Access Entry Role

0

Greetings,

I've create a EKS login pattern with Access Entry like this:

  1. Create Access Entry(let's say, EKSClusterAdminAccessEntry), attaching EKSClusterAdminPolicy and binding to an IAM Role (EKSClusterAdminRole) principal
  2. Define trust policy that EKSClusterAdminRole can be assume by my whole AWS account
  3. Create IAM user group (EKSCLusterAdminUserGroup) and add users to the group
  4. Attach assume role policy to the EKSClusterAdminUserGroup, allow the group to assume EKSClusterAdminRole

Now all the IAM users in IAM group (EKSClusterAdminUserGroup) can assume EKSClusterAdminRole to access my EKS cluster.

However, ever since the settings was done, I found that the users cannot view the Nodes in the AWS EKS Console anymore Enter image description here And here's always a warning appeared on the top: Enter image description here

Seems that though I can access the EKS cluster by assume EKSClusterAdminRole with --role-arn EKSClusterAdminRole.arn on my kubectl but EKS Console didn't know the role (EKSClusterAdminRole) which the users want to assume, so it block our access permissions

As I turn to create another Access Entry with EKSClusterAdminPolicy binding to an IAM User, one can see the nodes in the cluster normally.

But not only this is not the behavior I expected, it also violates the practice that suggest in the access entry creation document: "IAM best practices recommend accessing your cluster using IAM roles that have short-term credentials, rather than IAM users that have long-term credentials. "

Is there a plan to fix this or any better practice to suggest from AWS?

Topics
Containers
Tags
Amazon EKS Anywhere
Language
English

asked 2 years ago612 views

1 Answer
0

The issue you're experiencing is related to how Amazon EKS handles permissions for the AWS Management Console versus direct API access through tools like kubectl. While your setup allows users to access the EKS cluster via kubectl by assuming the EKSClusterAdminRole, the EKS Console requires additional configuration to recognize and use the assumed role.

To resolve this issue and allow users to view nodes and other resources in the EKS Console while still adhering to IAM best practices, you can try the following approach:

  1. Instead of creating an Access Entry for the IAM Role (EKSClusterAdminRole), create Access Entries for each individual IAM User in the EKSClusterAdminUserGroup.

  2. When creating these Access Entries, you can still associate them with the EKSClusterAdminPolicy, which grants the necessary permissions.

  3. In the Access Entry configuration, you can specify the Kubernetes groups that the users should belong to within the cluster. This allows you to map IAM users to Kubernetes RBAC roles.

  4. You may need to update your cluster's aws-auth ConfigMap to include mappings for these IAM users, associating them with the appropriate Kubernetes groups.

This approach allows the EKS Console to properly recognize the permissions granted to each user while still leveraging IAM roles for API and kubectl access. It maintains the use of short-term credentials through role assumption for direct cluster interactions while providing the necessary visibility in the console.

If you find that this solution doesn't fully address your needs or if you encounter any issues, it's recommended to contact AWS support for further assistance. They may be able to provide more specific guidance based on your exact setup and requirements.

Remember that EKS access management is an area that continues to evolve, and AWS may introduce improvements or new features to address these kinds of scenarios in the future.

Sources
AWS EKS User Access Within the Cluster | AWS re:Post
AccessPolicy - Amazon EKS
Troubleshoot Amazon EKS Connector issues - Amazon EKS
Troubleshoot problems with Amazon EKS clusters and nodes - Amazon EKS

answered 2 years ago

EXPERT

reviewed 2 years ago

  • Ray Chang
    2 years ago

    Thanks for the reply, I know I can create access entries for a list of users but my implementation is to connect IAM group with EKS cluster auth, so I don't have to add users to access entry one by one.

  • Ray Chang
    2 years ago

    Through granting specific IAM group permission to assume EKS cluster role, the users in the IAM group would be permitted to assume EKSClusterAdminRole. This works with kubectl with telling kubectl witch role the user want to assume, I wonder if

    1. there's way for AWS EKS Console to know that current user can assume EKSClusterAdminRole to enter EKS?
    2. there's any way that I can manage access entry for users with IAM group so I don't have to manage another AWS account list for the EKS cluster?

    Or the only way is to create access entry for each of the users?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content