<p>I deployed a EKS cluster via a IAM user and need to give full cluster permission to other aws sso users. I followed this instruction <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html</a> but still can't make it work.</p>
<p>I got below error when run this command by a sso user:</p>
<pre><code>$ kubectl get pods
error: You must be logged in to the server (Unauthorized)
</code></pre>
<p>In the doc they say to create <code>aws-auth</code> ConfigMap to map the role as below. But I am not sure what the role arn I should specify. I am using EKS + Fargate so there is no <code>node group</code> or <code>node instance</code> in my cluster. So what kind of role should I specify in below configuration&gt;</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: &lt;ARN of instance role (not instance profile)&gt;
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
</code></pre>

<p>You should specify:</p>
<pre><code>- rolearn: arn:aws:iam::&lt;aws account id&gt;:role/&lt;federated user&gt;
  username: {{SessionName}}
  groups:
    - system:masters
</code></pre>
<p>Please note that &quot;&lt; aws account id &gt;&quot; is the ID of the AWS account in which the EKS cluster is created, and &quot;&lt; federated user &gt;&quot; is the SSO user with which you are accessing this account. This policy will add admin access rights to your k8s cluster. You can obtain the &quot;&lt; federated user &gt;&quot; by logging into an account with that user and in the upper right corner do expand and you will see Federated user. Copy it, and it will look something like this AWSReservedSSO_AdministratorAccess_9999bb9bbbbfff/administrator. Take just the first part before the forward slash.</p>
