How does AWS user/role Access Kubernetes Resources

Imagine you have an AWS user, and you want it to access kubernetes reources like nodes, pods, etc in EKS. The user may want to run kubectl commands to check on different kubernetes resources like pods, services, secrets, etc from command prompt. The user may want to go to EKS console in AWS and try to see nodes, pods, etc are running or not. How are you going to achieve this? Lets look at it…..

First the IAM user should have access to the AWS EKS service. To do this user should have a role assigned which has a policy allowing EKS access. Or if EKS is in another account, then the user has to **assume role** which allows it to access AWS EKS service. But this is not enough to access nodes, pods, etc.

Next thing you need to do is grant IAM role of user or assumed role of user, acess to Kubernetes APIs. The AWS IAM authenticator for kubernetes is installed in the control plane. It enables IAM principals(user/role) that you want to give access to kubernetes resources in your cluster. One of the way is to Adding entries to the aws-auth ConfigMap

#Sample aws-auth ConfigMap 
apiVersion: v1
data:
  mapAccounts: |
    - "<Account ID>"
  mapRoles: |
    - "groups":
      - "system:bootstrappers"
      - "system:nodes"
      "rolearn": "<ARN of the role which is assumed by AWS user>"
      "username": "<Some name>"
    - "groups":
      - "system:masters"
      "rolearn": "<ARN of the role which is assumed by AWS user>"
      "username": "<Some name>"
  mapUsers: |
    - "groups":
      - "system:masters"
      "userarn": "IAM USER ARN"
      "username": "USER NAME"
    - "groups":
      - "system:masters"
      "userarn": "IAM USER ARN"
      "username": "USER NAME"