<p>I've initially run <code>aws --region eu-west-1 eks update-kubeconfig --name prod-1234 --role-arn arn:aws:iam::1234:user/chris-devops</code> to get access to the EKS cluster.</p>

<p>When doing anything like: <code>kubectl get ...</code> I get an error of:</p>

<blockquote>
  <p>An error occurred (AccessDenied) when calling the AssumeRole
  operation: User: arn:aws:iam::1234:user/chris-devops is not authorized
  to perform: sts:AssumeRole on resource:
  arn:aws:iam::1234:user/chris-devops</p>
</blockquote>

<p>Why do I get this error? How do I gain access?</p>

<p>I've added the following to the user:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::1234:user/chris-devops"
        }
    ]
}
</code></pre>

<p>In addition I also have full Administrator access:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}
</code></pre>

<p>I've read through: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_cant-assume-role" rel="noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_cant-assume-role</a> </p>

<p>And my understanding is I'm meeting all the criteria.</p>

<pre><code>aws eks --region eu-west-1 update-kubeconfig --name prod-eks-3flXvI2r --role-arn http://arn:aws:iam::1234:role/prod-eks-1234-admins
</code></pre>

<p>I had to specify the correct role... Woohooo</p>
