<p>According to documentation of both <a href="https://github.com/kubernetes/kops/blob/master/docs/aws.md" rel="nofollow noreferrer">kops</a> and <a href="https://aws.amazon.com/blogs/compute/kubernetes-clusters-aws-kops/" rel="nofollow noreferrer">aws</a>, the dedicated <code>kops</code> user needs <code>IAMFullAccess</code> permission to operate properly.</p>

<p>Why is this permission needed?</p>

<p>Is there a way to avoid (i.e. restrict) this, given that it is a bit too intrusive to create a user with such a permission?</p>

<p><strong>edit</strong>: one could assume that the specific permission is needed to attach the respective roles to the <a href="https://github.com/kubernetes/kops/blob/master/pkg/model/iam/tests/iam_builder_master_strict.json" rel="nofollow noreferrer">master(s)</a> and <a href="https://github.com/kubernetes/kops/blob/master/pkg/model/iam/tests/iam_builder_node_strict.json" rel="nofollow noreferrer">node(s)</a> instances; </p>

<p>therefore perhaps the question / challenge becomes how to:</p>

<ul>
<li>not use <code>IAMFullAccess</code></li>
<li>sync with the node creation / bootstrapping process and attach the above roles; (perhaps create a cluster on pre-configured instances? - no idea if kops provides for that)</li>
</ul>

<p>As far as I understand kops design, it's meant to be end to end tool for provisioning you with k8s clusters. If you want to provision your nodes separately and deploy k8s on them I would suggest to use other tool, such as kubespray or kubeadm: </p>

<p><a href="https://github.com/kubernetes-incubator/kubespray" rel="nofollow noreferrer">https://github.com/kubernetes-incubator/kubespray</a> </p>

<p><a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="nofollow noreferrer">https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/</a></p>
