Document minimum IAM requirements #204

NunoPinheiro · 2018-09-11T13:33:38Z

It would be nice to have a documentation listing the minimum IAM permissions to run eksctl.

I'm trying to set this up with a minimum service account, and now I have to add dependencies one by one.

If they were documented as a YAML that would be the best!

errordeveloper · 2018-09-11T14:55:12Z

@NunoPinheiro I'd recommend creating a cluster with an admin account, and looking and all resources that get created and use those as a basis to define a restricted policy.

Please note that we have #122. The code already accommodates for separating out IAM resources, all the resources are defined here:

https://github.com/weaveworks/eksctl/blob/6a4932de65265906aa91363d4eb1b02ae6dddda5/pkg/cfn/builder/iam.go

It should be fairly doable to implement what's being discussed in #122.

errordeveloper · 2018-10-30T09:51:20Z

I believe @mhausenblas was looking into this also.

dougireton · 2018-12-28T03:17:52Z

Here are the minimum AWS IAM permissions to create and delete clusters via eksctl

I verified them by running eksctl create cluster about 30 times adding permissions one by one.

CloudFormation

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "eksCtlCloudFormation",
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        }
    ]
}

EKS

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        }
    ]
}

AutoScaling

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration"
            ],
            "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup"
            ],
            "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations"
            ],
            "Resource": "*"
        }
    ]
}

IAM

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:GetRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::<AWS Acct Id>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS Acct Id>:role/eksctl-*"
            ]
        }
    ]
}

Networking

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EksInternetGateway",
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Sid": "EksNetworking",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*"
        }
    ]
}

errordeveloper · 2018-12-28T17:27:47Z

@dougireton thank you so much!!

errordeveloper · 2018-12-28T17:28:10Z

@dougireton @mhausenblas how do you think it would be best to document this? I worry if we just add this to the readme, it will get out of date too soon. Ideally, we should be able to generate this. The code already knows of this, but it's a little indirect.

VojtechVitek · 2018-12-29T01:11:25Z

I tried to create a custom IAM policy out of the above and after a couple of failed attempts (some actions were misssing, ie. ec2:DescribeVpcs and ec2:DescribeAddresses and autoscaling:DescribeScalingActivities), I managed to create a working custom IAM policy:

1. Create a custom IAM policy out of this JSON

Note that you need to replace <AWS Acct Id> with your AWS account ID. To get it:

Click My Account
Your 12-digit account ID is listed under Account Settings

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:GetRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::<AWS Acct Id>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS Acct Id>:role/eksctl-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:DescribeScalingActivities",
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*"
        }
    ]
}

2. Create a new IAM service role for CloudFormation and attach the above policy

3. Run `eksctl create cluster`

and it should work!

I'll be happy to create a Pull Request out of this, if you want me to.

errordeveloper · 2018-12-29T09:54:54Z

Thanks everyone for sharing so well-documented steps!

bensussman · 2019-03-05T20:37:18Z

Why is DeleteInternetGateway in the perms twice, once for resource * and once for resource "arn:aws:ec2:*:*:internet-gateway/*"? Shouldn't the former include the latter @VojtechVitek ?

VojtechVitek · 2019-03-05T20:49:21Z

@bensussman The above is not an official list of IAM policies; I compiled it while playing with eksctl and we don't really use it in production. Feel free to improve as you want.

bensussman · 2019-03-05T22:08:57Z

💔 @VojtechVitek bummer. Is the idea that users of eksctl are required to figure out the set of perms themselves? i used the set of perms listed in #204 (comment) and it did not work for me:

$ eksctl create cluster -n $CLUSTER_NAME -r us-west-2 --version 1.11 --nodegroup-name $NODEGROUP_NAME -t m5.large --nodes-min $MIN_NODES --nodes-max $MAX_NODES --node-volume-size 50 --ssh-access --ssh-public-key shared-key --asg-access --profile EksctlCreator
[ℹ]  using region us-west-2
[✖]  getting availability zones: getting availability zones for us-west-2: UnauthorizedOperation: You are not authorized to perform this operation.
	status code: 403, request id: 8ca46cb5-e89e-...

bensussman · 2019-03-05T22:21:00Z

I added ec2:DescribeAvailabilityZones and it let me move on to the next one, looks like it's unable to find the ami-0c28139856aaf9c3b. I wonder how any of these IAM policies were made, or has eksctl just changed a bunch in the 2 months since they were written (i doubt that)?

errordeveloper · 2019-03-05T22:51:45Z

Benjamin, I don't think there were any changes that would affect these. If you need more help, please do connect on Slack and we can discuss in real time. As I pointed out, I am keen to do what would need to be done to close this issue, but some form of help would be appreciated. At present all of my focus is on things related to cluster upgrades.

…

On Tue, 5 Mar 2019, 10:21 pm Benjamin Sussman, ***@***.***> wrote: I added ec2:DescribeAvailabilityZones and it let me move on to the next one, looks like it's unable to find the ami-0c28139856aaf9c3b. I wonder how any of these IAM policies were made, or has eksctl just changed a bunch in the 2 months since they were written (i doubt that)? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#204 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAPWS6OEXk-cE7kHDp6gRTso874ZWCqiks5vTu3MgaJpZM4WjUhl> .

bensussman · 2019-03-06T00:08:09Z

I got it working by giving it all ec2 permissions ec2:*. It's not a great fix, better to have the exact minimum set of perms, but I wanted to get to working on other stuff.

I would advise someone get the minimum set of perms (not sure if this list above has anything extraneous, but it's certainly missing a few things like DescribeAvailabilityZones, DescribeImage, a bunch of VPC related perms, etc.) and put it in a json file inside the repo so that users can easily grab it and create the appropriate policy for their aws account. For now, i would advise any reader to just use ec2:* in addition to any non-ec2 perms listed above.

errordeveloper · 2019-03-06T00:52:43Z

We should really automate this! To begin with we can add a command that creates the policy, and use it as part of the integration test suite. Any takers?

mailjunze · 2019-06-11T11:49:15Z

I added some missing permissions to the sample policy. Following IAM permissions should be enough to launch EKS cluster with worker nodes in a new VPC using eksctl.

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:GetRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::<AWS Acct Id>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS Acct Id>:role/eksctl-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:DescribeScalingActivities",
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:describeAddresses",
                "ec2:DescribeVpcs",
                "ec2:CreateLaunchTemplate",
                "ec2:DescribeLaunchTemplates",
                "ec2:RunInstances",
                "ec2:DescribeLaunchTemplateVersions"
            ],
            "Resource": "*"
        }
    ]
}

jonin · 2019-06-26T08:28:42Z

These are missing

I added some missing permissions to the sample policy. Following IAM permissions should be enough to launch EKS cluster with worker nodes in a new VPC using eksctl.

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",

"iam:DeleteServiceLinkedRole",
"iam:CreateServiceLinkedRole",

            "iam:GetRolePolicy"
        ],
        "Resource": [
            "arn:aws:iam::<AWS Acct Id>:instance-profile/eksctl-*",
            "arn:aws:iam::<AWS Acct Id>:role/eksctl-*"
        ]
    },

jonin · 2019-06-27T08:06:25Z

And if you need to delete a stack as well:

    {
        "Effect": "Allow",
        "Action": [
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:DeleteSubnet",
            "ec2:DeleteTags",
            "ec2:CreateNatGateway",
            "ec2:CreateVpc",
            "ec2:AttachInternetGateway",
            "ec2:DescribeVpcAttribute",
            "ec2:DeleteRouteTable",
            "ec2:AssociateRouteTable",
            "ec2:DescribeInternetGateways",
            "ec2:CreateRoute",
            "ec2:CreateInternetGateway",
            "ec2:RevokeSecurityGroupEgress",
            "ec2:CreateSecurityGroup",
            "ec2:ModifyVpcAttribute",
            "ec2:DeleteInternetGateway",
            "ec2:DescribeRouteTables",
            "ec2:ReleaseAddress",
            "ec2:AuthorizeSecurityGroupEgress",
            "ec2:DescribeTags",
            "ec2:CreateTags",
            "ec2:DeleteRoute",
            "ec2:CreateRouteTable",
            "ec2:DetachInternetGateway",
            "ec2:DescribeNatGateways",
            "ec2:DisassociateRouteTable",
            "ec2:AllocateAddress",
            "ec2:DescribeSecurityGroups",
            "ec2:RevokeSecurityGroupIngress",
            "ec2:DeleteSecurityGroup",
            "ec2:DeleteNatGateway",
            "ec2:DeleteVpc",
            "ec2:CreateSubnet",
            "ec2:DescribeSubnets",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeImages",
            "ec2:describeAddresses",
            "ec2:DescribeVpcs",
            "ec2:CreateLaunchTemplate",
            "ec2:DescribeLaunchTemplates",
            "ec2:RunInstances",

"ec2:DeleteLaunchTemplate",

            "ec2:DescribeLaunchTemplateVersions"
        ],
        "Resource": "*"
    }

(And for decoding the authorization error message that you will get in the console without that: sts:DecodeAuthorizationMessage.)

thapakazi · 2019-06-27T08:24:49Z

Lets document these complete in wiki page or somewhere first, so many people are dwelling for same stuffs.

jonin · 2019-06-27T10:03:00Z

And probably some additional permissions are required for SSH access. Trying to enable it results in:

[X] searching for SSH public key "eksctl-{cluster-name}-nodegroup-{nodegroup-name}-{fingerprint}" in EC2: UnauthorizedOperation:
You are not authorized to perform this operation.
status code: 403, request id: {request-id}

gmagella-ca · 2019-07-04T16:12:23Z

Here is the policy that worked for me. Fixes SSH import key and describe key:
Three permissions were missing:
"ec2:DescribeImageAttribute",
"ec2:DescribeKeyPairs",
"ec2:ImportKeyPair"

So here we have the full policy with @jonin contributions and mine:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:GetRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eksctl-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:DescribeScalingActivities",
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:describeAddresses",
                "ec2:DescribeVpcs",
                "ec2:CreateLaunchTemplate",
                "ec2:DescribeLaunchTemplates",
                "ec2:RunInstances",
                "ec2:DeleteLaunchTemplate",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:DescribeImageAttribute",
                "ec2:DescribeKeyPairs",
                "ec2:ImportKeyPair"
            ],
            "Resource": "*"
        }
    ]
}

OscarAyoy · 2019-07-31T12:31:54Z

FWIW I had to add the following Resource to the iam-statement from the policy above in order to get this to work:

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",

[...]

                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [

"arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",

                "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eksctl-*"
            ]
        }
    ]
}

mutabletao · 2019-08-01T22:44:21Z

I have all of these permissions in the IAM role I'm using to try to use eksctl create cluster. I have verified using sts that the IAM role expected is the one executing the command. I still get errors saying that I am "not authorized to perform this operation" on eksctl referencing operations I have the permissions to perform in the policy I can directly see. - example:AWS::EC2::InternetGateway/InternetGateway: CREATE_FAILED – "API: ec2:CreateInternetGateway You are not authorized to perform this operation."
yet the policy contains:"ec2:CreateInternetGateway", on Resource "*" - and the IAM user has Administrative Access to the account...

I have run exactly the same command with exactly the same permissions in another account exactly the same way and it works. I cannot find any difference in the accounts other than the non-working one has MFA.. but it only errors out on 3 commands.

tsunhua · 2019-08-07T06:31:28Z

I tried to create a cluster under the policies mentioned in #204 (comment) , but failed. It said that

AWS::AutoScaling::AutoScalingGroup/NodeGroup: CREATE_FAILED – "API: autoscaling:CreateAutoScalingGroup You are not authorized to use launch template: eksctl-cafe-eks-28-nodegroup-standard-workers"

Then I found the document https://docs.aws.amazon.com/autoscaling/ec2/userguide/control-access-using-iam.html, which said that

Users must have additional permissions from Amazon EC2 and IAM to perform certain actions. You specify the following actions in the Action element of an IAM policy statement.

Create an Auto Scaling group using a launch template

autoscaling:CreateAutoScalingGroup
iam:CreateServiceLinkedRole
ec2:RunInstances

I added the following policies, and it worked (^▽^)

iam:CreateServiceLinkedRole
ec2:RunInstances

mutabletao · 2019-08-08T13:23:57Z

I have
autoscaling:CreateAutoScalingGroup
iam:CreateServiceLinkedRole
ec2:RunInstances
in the policy and eksctl still doesn't work.
I think it's related to MFA vs non-MFA accounts.. but if anyone has any ideas.. I've had to resort to trying to work through the console and give up on eksctl since I can't get it to work....

E-r1ck · 2019-08-15T23:44:17Z

@mutabletao are you using a MFA user? If so, I believe you need to set up a session token to ensure proper connectivity between running CLI commands and your user.

alexmarica · 2019-08-22T09:37:32Z

Hello, same here. I'm using the latest compiled set of permissions for the EKS service role and still not able to have the node-group created:

AWS::AutoScaling::AutoScalingGroup/NodeGroup: CREATE_FAILED – "API: autoscaling:CreateAutoScalingGroup You are not authorized to use launch template: eksctl-dev-k8s-us-east-1-nodegroup-dev-k8s-us-east-1-standard"

I'm launching eksctl with an admin user which is not an MFA enabled user

eksctl create cluster -f cluster-config.yaml

smiklosovic · 2019-09-12T08:32:44Z

This is ridiculous, is not there any exact list of permissions / roles to enable to try this stuff out?

KNCal · 2019-10-07T05:47:07Z

Under IAM -> Groups -> Permissions, click Attach Policy worked for me, using the above json from @mailjunze and steps from @VojtechVitek.

uny · 2019-11-24T01:55:05Z

If you use eksctl create cluster --managed, this will work.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:CreateRole",
                "iam:CreateServiceLinkedRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:DetachRolePolicy",
                "iam:GetInstanceProfile",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile"
            ],
            "Resource": [
                "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eksctl-*",
                "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eksctl-*",
                "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:describeAddresses",
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        }
    ]
}

iam:ListAttachedRolePolicies and arn:aws:iam::<AWS Acct Id>:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup are needed.

JulienDefrance · 2020-01-09T22:11:08Z

@uny You might want to make sure you remove your AWS Account ID from the above comment.

uny · 2020-01-10T05:20:56Z

@JulienDefrance
Thank you, I replaced them.

caleno · 2020-02-27T09:48:45Z

CloudFormation template example for EKSctl manged cluster policy

ref: #204 (comment)

---
Description: Eksctl provisioner policy for manged cluster

Resources:
  EksctlProvisionerManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: eksctl-provisioner-managed
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowSomeIamActions
            Action:
              - 'iam:AddRoleToInstanceProfile'
              - 'iam:AttachRolePolicy'
              - 'iam:CreateInstanceProfile'
              - 'iam:CreateRole'
              - 'iam:GetRole'
              - 'iam:CreateServiceLinkedRole'
              - 'iam:DeleteInstanceProfile'
              - 'iam:DeleteRole'
              - 'iam:DeleteRolePolicy'
              - 'iam:DeleteServiceLinkedRole'
              - 'iam:DetachRolePolicy'
              - 'iam:GetInstanceProfile'
              - 'iam:GetRole'
              - 'iam:GetRolePolicy'
              - 'iam:ListAttachedRolePolicies'
              - 'iam:ListInstanceProfiles'
              - 'iam:ListInstanceProfilesForRole'
              - 'iam:PassRole'
              - 'iam:PutRolePolicy'
              - 'iam:RemoveRoleFromInstanceProfile'
              - 'iam:GetOpenIDConnectProvider'
            Effect: Allow
            Resource:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:instance-profile/eksctl-*'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/eksctl-*'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/*'
          - Sid: AllowCloudforamtionAction
            Action:
              - 'cloudformation:*'
            Effect: Allow
            Resource: '*'
          - Sid: AllowEksAction
            Action:
              - 'eks:*'
            Effect: Allow
            Resource: '*'
          - Sid: AllowIGWAction
            Action:
              - 'ec2:DeleteInternetGateway'
            Effect: Allow
            Resource: 'arn:aws:ec2:*:*:internet-gateway/*'
          - Sid: AllowEc2Action
            Action:
              - 'ec2:AuthorizeSecurityGroupIngress'
              - 'ec2:DeleteSubnet'
              - 'ec2:DeleteTags'
              - 'ec2:CreateNatGateway'
              - 'ec2:CreateVpc'
              - 'ec2:AttachInternetGateway'
              - 'ec2:DescribeVpcAttribute'
              - 'ec2:DeleteRouteTable'
              - 'ec2:AssociateRouteTable'
              - 'ec2:DescribeInternetGateways'
              - 'ec2:CreateRoute'
              - 'ec2:CreateInternetGateway'
              - 'ec2:RevokeSecurityGroupEgress'
              - 'ec2:CreateSecurityGroup'
              - 'ec2:ModifyVpcAttribute'
              - 'ec2:DeleteInternetGateway'
              - 'ec2:DescribeRouteTables'
              - 'ec2:ReleaseAddress'
              - 'ec2:AuthorizeSecurityGroupEgress'
              - 'ec2:DescribeTags'
              - 'ec2:CreateTags'
              - 'ec2:DeleteRoute'
              - 'ec2:CreateRouteTable'
              - 'ec2:DetachInternetGateway'
              - 'ec2:DescribeNatGateways'
              - 'ec2:DisassociateRouteTable'
              - 'ec2:AllocateAddress'
              - 'ec2:DescribeSecurityGroups'
              - 'ec2:RevokeSecurityGroupIngress'
              - 'ec2:DeleteSecurityGroup'
              - 'ec2:DeleteNatGateway'
              - 'ec2:DeleteVpc'
              - 'ec2:CreateSubnet'
              - 'ec2:DescribeSubnets'
              - 'ec2:DescribeAvailabilityZones'
              - 'ec2:DescribeImages'
              - 'ec2:describeAddresses'
              - 'ec2:DescribeVpcs'
            Effect: Allow
            Resource: '*'

sreejithcts · 2020-04-12T00:57:14Z

The above policy didn't allow to create unmanaged Node Group and delete a cluster. Added additional permissions to the policy. Please find the updated one..

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteSubnet",
"eks:DescribeFargateProfile",
"eks:ListTagsForResource",
"eks:UpdateClusterConfig",
"ec2:AttachInternetGateway",
"ec2:DeleteRouteTable",
"ec2:AssociateRouteTable",
"ec2:DescribeInternetGateways",
"eks:DescribeNodegroup",
"ssm:DescribeParameters",
"autoscaling:DescribeAutoScalingGroups",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:RevokeSecurityGroupEgress",
"autoscaling:UpdateAutoScalingGroup",
"ec2:DeleteInternetGateway",
"ec2:DescribeKeyPairs",
"ec2:DescribeRouteTables",
"eks:ListNodegroups",
"ec2:ImportKeyPair",
"ec2:DescribeLaunchTemplates",
"ec2:CreateTags",
"ec2:CreateRouteTable",
"cloudformation:",
"ec2:RunInstances",
"ec2:DetachInternetGateway",
"ec2:DisassociateRouteTable",
"eks:DeleteCluster",
"ec2:RevokeSecurityGroupIngress",
"eks:DeleteNodegroup",
"ec2:DescribeImageAttribute",
"eks:UpdateNodegroupConfig",
"ec2:DeleteNatGateway",
"eks:DescribeCluster",
"eks:ListClusters",
"autoscaling:DeleteAutoScalingGroup",
"ec2:DeleteVpc",
"ec2:CreateSubnet",
"ec2:DescribeSubnets",
"autoscaling:CreateAutoScalingGroup",
"eks:UpdateClusterVersion",
"ec2:DescribeAddresses",
"ec2:DeleteTags",
"ec2:CreateNatGateway",
"autoscaling:DescribeLaunchConfigurations",
"ec2:CreateVpc",
"ec2:DescribeVpcAttribute",
"eks:UpdateNodegroupVersion",
"autoscaling:DescribeScalingActivities",
"ec2:DescribeAvailabilityZones",
"eks:ListUpdates",
"ec2:CreateSecurityGroup",
"ec2:ModifyVpcAttribute",
"eks:CreateCluster",
"ec2:ReleaseAddress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:DeleteLaunchTemplate",
"eks:UntagResource",
"ec2:DescribeTags",
"ec2:DeleteRoute",
"ec2:DescribeLaunchTemplateVersions",
"eks:CreateNodegroup",
"ec2:DescribeNatGateways",
"ec2:AllocateAddress",
"ec2:DescribeSecurityGroups",
"autoscaling:CreateLaunchConfiguration",
"ec2:DescribeImages",
"eks:ListFargateProfiles",
"ec2:CreateLaunchTemplate",
"autoscaling:DeleteLaunchConfiguration",
"eks:DescribeUpdate",
"ec2:DescribeVpcs",
"eks:TagResource",
"ec2:DeleteSecurityGroup"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:GetRole",
"iam:GetInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:CreateRole",
"iam:DeleteRole",
"iam:AttachRolePolicy",
"iam:PutRolePolicy",
"iam:ListInstanceProfiles",
"iam:AddRoleToInstanceProfile",
"iam:ListInstanceProfilesForRole",
"iam:PassRole",
"iam:CreateServiceLinkedRole",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"ec2:DeleteInternetGateway",
"iam:DeleteServiceLinkedRole",
"iam:GetOpenIDConnectProvider",
"iam:GetRolePolicy"
],
"Resource": [
"arn:aws:ec2:::internet-gateway/",
"arn:aws:iam:::oidc-provider/",
"arn:aws:iam:::instance-profile/",
"arn:aws:iam:::role/"
]
},
{
"Effect": "Allow",
"Action": "ssm:GetParameter",
"Resource": "arn:aws:ssm:::parameter/"
},
{
"Effect": "Allow",
"Action": [
"ssm:GetParameters",
"ssm:GetParameter"
],
"Resource": "arn:aws:ssm:::parameter/*"
}
]
}

alanoberto · 2020-04-20T13:46:09Z

Please @sreejithcts comment the difference between your and above, otherwise is hard to see what you add, thanks

yoadshirancnvrg · 2020-05-14T07:08:32Z

I ran "eksctl create cluster" with this policy and it works for me


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:AddRoleToInstanceProfile",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:CreateServiceLinkedRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "ec2:DeleteInternetGateway",
                "iam:GetRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::<AccountID>:instance-profile/eksctl-*",
                "arn:aws:iam::<AccountID>:role/eksctl-*",
                "arn:aws:ec2:*:*:internet-gateway/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand",
                "ssm:CancelCommand",
                "ec2:AuthorizeSecurityGroupIngress",
                "ssm:SendAutomationSignal",
                "ssm:CreateActivation",
                "ec2:AttachInternetGateway",
                "ssm:UpdateAssociation",
                "ssm:CreateOpsItem",
                "ssm:UpdateAssociationStatus",
                "ssm:StartSession",
                "ec2:DeleteRouteTable",
                "ssm:RegisterPatchBaselineForPatchGroup",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:DeleteInternetGateway",
                "ssm:UpdateDocument",
                "ec2:DescribeKeyPairs",
                "ssm:UpdateManagedInstanceRole",
                "ssm:UpdatePatchBaseline",
                "ssm:RegisterTaskWithMaintenanceWindow",
                "ec2:ImportKeyPair",
                "ec2:CreateTags",
                "ec2:RunInstances",
                "ec2:DisassociateRouteTable",
                "ssm:CreateDocument",
                "ec2:RevokeSecurityGroupIngress",
                "ssm:UpdateMaintenanceWindow",
                "ssm:StartAutomationExecution",
                "ssm:CancelMaintenanceWindowExecution",
                "ssm:CreateAssociation",
                "ec2:DescribeImageAttribute",
                "ec2:DeleteNatGateway",
                "autoscaling:DeleteAutoScalingGroup",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ssm:UpdateMaintenanceWindowTask",
                "ec2:DescribeVpcAttribute",
                "ssm:CreatePatchBaseline",
                "ssm:ResetServiceSetting",
                "ssm:DeleteInventory",
                "ec2:DescribeAvailabilityZones",
                "autoscaling:DescribeScalingActivities",
                "ssm:CreateResourceDataSync",
                "ssm:CreateMaintenanceWindow",
                "ec2:ReleaseAddress",
                "ec2:DeleteLaunchTemplate",
                "ssm:DeregisterPatchBaselineForPatchGroup",
                "ssm:StopAutomationExecution",
                "ec2:DescribeSecurityGroups",
                "ssm:UpdateOpsItem",
                "ssm:UpdateServiceSetting",
                "autoscaling:CreateLaunchConfiguration",
                "ec2:CreateLaunchTemplate",
                "ssm:CreateAssociationBatch",
                "ssm:ModifyDocumentPermission",
                "ec2:DescribeVpcs",
                "ssm:RegisterDefaultPatchBaseline",
                "ssm:UpdateInstanceAssociationStatus",
                "ssm:LabelParameterVersion",
                "ec2:DeleteSubnet",
                "ssm:DeregisterTargetFromMaintenanceWindow",
                "ssm:ResumeSession",
                "ssm:UpdateDocumentDefaultVersion",
                "ssm:UpdateMaintenanceWindowTarget",
                "ssm:GetParameter",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ssm:DeleteActivation",
                "ssm:DeleteParameter",
                "ssm:StartAssociationsOnce",
                "ssm:UpdateInstanceInformation",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:UpdateAutoScalingGroup",
                "ssm:PutComplianceItems",
                "ec2:DescribeRouteTables",
                "ec2:DescribeLaunchTemplates",
                "ec2:CreateRouteTable",
                "ssm:RegisterTargetWithMaintenanceWindow",
                "cloudformation:*",
                "ssm:GetParameters",
                "ec2:DetachInternetGateway",
                "ssm:DeleteParameters",
                "ssm:PutParameter",
                "ssm:UpdateResourceDataSync",
                "ec2:DeleteVpc",
                "eks:*",
                "autoscaling:CreateAutoScalingGroup",
                "ec2:DescribeAddresses",
                "ec2:DeleteTags",
                "autoscaling:DescribeLaunchConfigurations",
                "ssm:TerminateSession",
                "ssm:DeletePatchBaseline",
                "ssm:DeleteResourceDataSync",
                "ec2:CreateSecurityGroup",
                "ssm:DeregisterTaskFromMaintenanceWindow",
                "ec2:ModifyVpcAttribute",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:DeleteRoute",
                "ec2:DescribeLaunchTemplateVersions",
                "ssm:DeleteMaintenanceWindow",
                "ec2:DescribeNatGateways",
                "ssm:DeleteAssociation",
                "ssm:DescribeParameters",
                "ssm:DeregisterManagedInstance",
                "ec2:AllocateAddress",
                "ec2:DescribeImages",
                "ssm:PutInventory",
                "autoscaling:DeleteLaunchConfiguration",
                "ec2:DeleteSecurityGroup",
                "ssm:DeleteDocument"
            ],
            "Resource": "*"
        },
        {
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": "arn:aws:ssm:<region>:redacted:parameter/*",
            "Effect": "Allow"
        }
    ]
}

cdmadrigal · 2020-05-20T17:54:43Z

Ran the following command: eksctl create cluster --name prod-test-8 --version 1.15 --region us-east-1 --nodegroup-name standard-workers --node-type t2.small --nodes 2 --nodes-min 1 --nodes-max 4

With the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:CreateRole",
                "iam:CreateServiceLinkedRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:DetachRolePolicy",
                "iam:GetInstanceProfile",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfilesForRole",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:CreateServiceLinkedRole",
                "iam:ListRoleTags"
            ],
            "Resource": [
                "arn:aws:iam::account-id:instance-profile/eksctl-*",
                "arn:aws:iam::account-id:role/eksctl-*",
                "arn:aws:iam::account-id:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:DescribeParameters"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ssm:GetParameter",
            "Resource": "arn:aws:ssm::::parameter/"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter",
                "ssm:GetParameters"
            ],
            "Resource": "arn:aws:ssm::::parameter/*"
        },
        {
            "Effect": "Allow",
            "Action": "cloudformation:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteInternetGateway",
            "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:DeleteLaunchConfiguration"
            ],
            "Resource": "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:CreateAutoScalingGroup"
            ],
            "Resource": "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:DescribeScalingActivities"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:CreateNatGateway",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:ModifySubnetAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteRoute",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:describeAddresses",
                "ec2:DescribeVpcs",
                "ec2:CreateLaunchTemplate",
                "ec2:DescribeLaunchTemplates",
                "ec2:DeleteLaunchTemplate",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:RunInstances"
            ],
            "Resource": "*"
        }
    ]
}

Replaced account-id with my actual AWS account id to get it to run. This policy is based off of the work done above but cleaned up so it's better understood.

paulmiller3000 · 2020-08-10T14:08:54Z

I just want to thank everyone for this thread. I came here after running into several issues. With special thanks to @dougireton , @mailjunze ,@jonin , and @OscarAyoy , I was able to get it done.

panilo · 2021-10-06T09:46:12Z

Hello folks,
I've been playing with EKS recently and I got some issues with the proposed policy above. I finally got mine working, sharing below

eksctl version 0.68.9
command eksctl create cluster --name blabla --region eu-west-1 --managed
platform win

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EC2IG",
      "Effect": "Allow",
      "Action": "ec2:DeleteInternetGateway",
      "Resource": "arn:aws:ec2:*:*:internet-gateway/*"
    },
    {
      "Sid": "ELBIAM",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IAM",
      "Effect": "Allow",
      "Action": [
        "iam:CreateInstanceProfile",
        "iam:DeleteInstanceProfile",
        "iam:GetRole",
        "iam:GetInstanceProfile",
        "iam:RemoveRoleFromInstanceProfile",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:ListInstanceProfiles",
        "iam:AddRoleToInstanceProfile",
        "iam:ListInstanceProfilesForRole",
        "iam:PassRole",
        "iam:CreateServiceLinkedRole",
        "iam:DetachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DeleteServiceLinkedRole",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies"
      ],
      "Resource": [
        "arn:aws:iam::*:instance-profile/eksctl-*",
        "arn:aws:iam::*:role/eksctl-*",
        "arn:aws:iam::*:role/aws-service-role/eks.amazonaws.com/*",
        "arn:aws:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/*"
      ]
    },
    {
      "Sid": "IAMOIDC",
      "Effect": "Allow",
      "Action": "iam:GetOpenIDConnectProvider",
      "Resource": "arn:aws:iam::557309985620:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/*"
    },
    {
      "Sid": "EC2",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DescribeInstances",
        "ec2:AttachInternetGateway",
        "ec2:DeleteRouteTable",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:CreateRoute",
        "ec2:CreateInternetGateway",
        "ec2:DescribeVolumes",
        "ec2:DeleteInternetGateway",
        "ec2:DescribeKeyPairs",
        "ec2:ImportKeyPair",
        "ec2:CreateTags",
        "ec2:RunInstances",
        "ec2:DisassociateRouteTable",
        "ec2:CreateVolume",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:DescribeImageAttribute",
        "ec2:DeleteNatGateway",
        "ec2:CreateSubnet",
        "ec2:DescribeSubnets",
        "ec2:AttachVolume",
        "ec2:CreateNatGateway",
        "ec2:CreateVpc",
        "ec2:DescribeVpcAttribute",
        "ec2:ModifySubnetAttribute",
        "ec2:DescribeAvailabilityZones",
        "ec2:ReleaseAddress",
        "ec2:DeleteLaunchTemplate",
        "ec2:DescribeSecurityGroups",
        "ec2:CreateLaunchTemplate",
        "ec2:DescribeVpcs",
        "ec2:DeleteSubnet",
        "ec2:DescribeVolumesModifications",
        "ec2:AssociateRouteTable",
        "ec2:DescribeInternetGateways",
        "ec2:DeleteVolume",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeRouteTables",
        "ec2:DetachVolume",
        "ec2:ModifyVolume",
        "ec2:DescribeLaunchTemplates",
        "ec2:CreateRouteTable",
        "ec2:DetachInternetGateway",
        "ec2:DeleteVpc",
        "ec2:DescribeAddresses",
        "ec2:DeleteTags",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:CreateSecurityGroup",
        "ec2:ModifyVpcAttribute",
        "ec2:ModifyInstanceAttribute",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:DescribeTags",
        "ec2:DeleteRoute",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeNatGateways",
        "ec2:AllocateAddress",
        "ec2:DescribeImages",
        "ec2:DeleteSecurityGroup"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ELB",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:ModifyListener",
        "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
        "elasticloadbalancing:CreateTargetGroup",
        "elasticloadbalancing:AddTags",
        "elasticloadbalancing:DeleteLoadBalancerListeners",
        "elasticloadbalancing:ModifyLoadBalancerAttributes",
        "elasticloadbalancing:CreateLoadBalancerPolicy",
        "elasticloadbalancing:CreateLoadBalancer",
        "elasticloadbalancing:DeleteTargetGroup",
        "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DeleteListener",
        "elasticloadbalancing:DetachLoadBalancerFromSubnets",
        "elasticloadbalancing:RegisterTargets",
        "elasticloadbalancing:DeleteLoadBalancer",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeLoadBalancerPolicies",
        "elasticloadbalancing:ModifyTargetGroupAttributes",
        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
        "elasticloadbalancing:DeregisterTargets",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:ConfigureHealthCheck",
        "elasticloadbalancing:CreateListener",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
        "elasticloadbalancing:AttachLoadBalancerToSubnets",
        "elasticloadbalancing:CreateLoadBalancerListeners",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:ModifyTargetGroup"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ECR",
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:InitiateLayerUpload",
        "ecr:ListImages",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:PutImage",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload",
        "ecr:DescribeRepositories"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AUTOSCALING",
      "Effect": "Allow",
      "Action": [
        "autoscaling:DeleteAutoScalingGroup",
        "autoscaling:DescribeScalingActivities",
        "autoscaling:CreateLaunchConfiguration",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:DescribeLaunchConfigurations",
        "autoscaling:DeleteLaunchConfiguration"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSM",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParametersByPath",
        "ssm:GetParameter",
        "ssm:DeleteParameter",
        "ssm:DescribeParameters",
        "ssm:GetParameters",
        "ssm:DeleteParameters",
        "ssm:PutParameter",
        "ssm:GetParameterHistory"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Full",
      "Effect": "Allow",
      "Action": ["cloudformation:*", "eks:*"],
      "Resource": "*"
    },
    {
      "Sid": "KMS",
      "Effect": "Allow",
      "Action": ["kms:DescribeKey"],
      "Resource": "*"
    },
    {
      "Sid": "IAMGetRole",
      "Effect": "Allow",
      "Action": ["iam:GetRole"],
      "Resource": "*"
    }
  ]
}

Rename verify-all file name

errordeveloper added the help wanted Extra attention is needed label Sep 11, 2018

errordeveloper added the hacktoberfest label Oct 4, 2018

errordeveloper mentioned this issue Dec 28, 2018

create cluster fails with ec2.* access errors #365

Closed

errordeveloper removed the hacktoberfest label Jan 18, 2019

errordeveloper mentioned this issue Feb 25, 2019

Improvements around setting up IAM (also for multiple clusters) #573

Closed

errordeveloper mentioned this issue Jun 4, 2019

Unable to create nodegroup on Gittag 0.1.33 due IAM Role #834

Closed

kingdonb mentioned this issue Nov 9, 2019

Support IAM permissions boundary policies for service and instance roles #1221

Closed

lgg42 mentioned this issue May 22, 2020

Fail to create new cluster with service role error #2182

Closed

martina-if self-assigned this May 27, 2020

martina-if mentioned this issue May 29, 2020

Document minimum IAM policies #2267

Merged

2 tasks

michaelbeaumont closed this as completed in #2267 Jun 2, 2020

martina-if removed their assignment Jan 13, 2022

torredil pushed a commit to torredil/eksctl that referenced this issue May 20, 2022

Merge pull request eksctl-io#204 from leakingtapan/verify

7d19895

Rename verify-all file name

Document minimum IAM requirements #204

Document minimum IAM requirements #204

Comments

NunoPinheiro commented Sep 11, 2018

errordeveloper commented Sep 11, 2018

errordeveloper commented Oct 30, 2018

dougireton commented Dec 28, 2018 • edited Loading

errordeveloper commented Dec 28, 2018

errordeveloper commented Dec 28, 2018

VojtechVitek commented Dec 29, 2018 • edited Loading

1. Create a custom IAM policy out of this JSON

2. Create a new IAM service role for CloudFormation and attach the above policy

3. Run eksctl create cluster

errordeveloper commented Dec 29, 2018

bensussman commented Mar 5, 2019

VojtechVitek commented Mar 5, 2019

bensussman commented Mar 5, 2019 • edited Loading

bensussman commented Mar 5, 2019

errordeveloper commented Mar 5, 2019 via email

bensussman commented Mar 6, 2019

errordeveloper commented Mar 6, 2019 via email • edited Loading

mailjunze commented Jun 11, 2019

jonin commented Jun 26, 2019

jonin commented Jun 27, 2019 • edited Loading

thapakazi commented Jun 27, 2019

jonin commented Jun 27, 2019 • edited Loading

gmagella-ca commented Jul 4, 2019

OscarAyoy commented Jul 31, 2019 • edited Loading

mutabletao commented Aug 1, 2019

tsunhua commented Aug 7, 2019 • edited Loading

mutabletao commented Aug 8, 2019

E-r1ck commented Aug 15, 2019

alexmarica commented Aug 22, 2019

smiklosovic commented Sep 12, 2019 • edited Loading

KNCal commented Oct 7, 2019

uny commented Nov 24, 2019 • edited Loading

JulienDefrance commented Jan 9, 2020

uny commented Jan 10, 2020

caleno commented Feb 27, 2020

sreejithcts commented Apr 12, 2020

alanoberto commented Apr 20, 2020

yoadshirancnvrg commented May 14, 2020 • edited Loading

cdmadrigal commented May 20, 2020

paulmiller3000 commented Aug 10, 2020

panilo commented Oct 6, 2021

dougireton commented Dec 28, 2018 •

edited

Loading

VojtechVitek commented Dec 29, 2018 •

edited

Loading

3. Run `eksctl create cluster`

bensussman commented Mar 5, 2019 •

edited

Loading

errordeveloper commented Mar 6, 2019 via email •

edited

Loading

jonin commented Jun 27, 2019 •

edited

Loading

jonin commented Jun 27, 2019 •

edited

Loading

OscarAyoy commented Jul 31, 2019 •

edited

Loading

tsunhua commented Aug 7, 2019 •

edited

Loading

smiklosovic commented Sep 12, 2019 •

edited

Loading

uny commented Nov 24, 2019 •

edited

Loading

yoadshirancnvrg commented May 14, 2020 •

edited

Loading