<p>Does anyone know what should be the minimum IAM permissions that would allow a user creating an EKS cluster?</p>

<p>I'm assuming a role to just create a cluster with Terraform and that role has got the following statements in its policy defined (nothing more than that):</p>

<pre><code>        {
            "Sid": "AllowEKSCreate",
            "Effect": "Allow",
            "Action": [
                "eks:List*",
                "eks:Describe*",
                "eks:CreateCluster",
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowEKSAll",
            "Effect": "Allow",
            "Action": "eks:*",
            "Resource": "arn:aws:eks:eu-west-1:XXXXXXXXXX:cluster/my-cluster"
        }
</code></pre>

<p>In CloudTrail I'am only seeing:</p>

<pre><code>AWS access key: XXXXXXXX
AWS region: eu-west-1
Error code: AccessDenied
Event ID: XXXXXXXX
Event name: CreateCluster
Event source: eks.amazonaws.com
</code></pre>

<p>Successful events:</p>

<ul>
<li>sts:GetCallerIdentity</li>
<li>ec2:DescribeAccountAttributes</li>
</ul>

<p>No other event is present in CloudTrail that would be unsuccessful.</p>

<p>Found it!</p>

<p>The missing permission was <code>iam:PassRole</code> on the Cluster IAM Role resource.</p>

<p>For some reason CloudTrail does not reveal that information :(</p>

<p>P.S.
I think I made my question very clear so am wondering why someone would give me -1.</p>
