<p><a href="https://i.stack.imgur.com/8M0Qx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8M0Qx.png" alt="enter image description here" /></a></p>
<p>I created an EC2 instance and an EKS cluster in the same AWS account.
In order to use the EKS cluster from EC2, I have to grant necessary permissions to it.</p>
<p>I added an instance profile role with some EKS operation permissions. Its role arn is <code>arn:aws:iam::11111111:role/ec2-instance-profile-role</code>(A) on dashboard. But in the EC2 instance, it can be found as <code>arn:aws:sts::11111111:assumed-role/ec2-instance-profile-role/i-00000000</code>(B).</p>
<pre><code>$ aws sts get-caller-identity
{
    &quot;Account&quot;: &quot;11111111&quot;,
    &quot;UserId&quot;: &quot;AAAAAAAAAAAAAAA:i-000000000000&quot;,
    &quot;Arn&quot;: &quot;arn:aws:sts::11111111:assumed-role/ec2-instance-profile-role/i-00000000&quot;
}
</code></pre>
<p>I also created an <code>aws-auth</code> config map to set into Kubernetes' system config in EKS, in order to allow the EC2 instance profile role can be registered and accessible. I tried both A and B to set into the mapRoles, all of them got the same issue. When I run <code>kubectl</code> command on EC2:</p>
<pre><code>$ aws eks --region aws-region update-kubeconfig --name eks-cluster-name

$ kubectl config view --minify
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://xxxxxxxxxxxxxxxxxxxxxxxxxxxx.aw1.aws-region.eks.amazonaws.com
  name: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
contexts:
- context:
    cluster: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
    user: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
  name: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
current-context: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
kind: Config
preferences: {}
users:
- name: arn:aws:eks:aws-region:11111111:cluster/eks-cluster-name
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - aws-region
      - eks
      - get-token
      - --cluster-name
      - eks-cluster-name
      - --role
      - arn:aws:sts::11111111:assumed-role/ec2-instance-profile-role/i-00000000
      command: aws
      env: null
      provideClusterInfo: false

$kubectl get svc
error: You must be logged in to the server (Unauthorized)
</code></pre>
<p>I also checked the type of the assumed role. It's <code>Service</code> but not <code>AWS</code>.</p>
<p>It seems this type is necessary.</p>
<pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: { &quot;AWS&quot;: &quot;arn:aws:iam:: 333333333333:root&quot; },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
}
</code></pre>
<p><a href="https://stackoverflow.com/questions/59704676/terraform-aws-assume-role/59705497#59705497">Terraform aws assume role</a></p>
<p>But I tried to create a new assume role with <code>AWS</code> type and set it to Kubernetes' <code>aws-auth</code> config map, still the same issue.</p>
<p>How to use it? Do I need to create a new IAM user to use?</p>

<pre><code>- name: external-staging
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - exec
      - test-dev
      - --
      - aws
      - eks
      - get-token
      - --cluster-name
      - eksCluster-1234
      - --role-arn
      - arn:aws:iam::3456789002:role/eks-cluster-admin-role-e65f32f
      command: aws-vault
      env: null
</code></pre>
<p>this config file working for me. it should be <code>role-arn</code> &amp; <code>command: aws-vault</code></p>
