<p>Trying to setup a EKS cluster.
An error occurred (AccessDeniedException) when calling the <code>DescribeCluster operation</code>: <strong>Account xxx is not authorized</strong> to use this service. This error came form the CLI, on the console I was able to crate the cluster and everything successfully.
I am logged in as the <code>root user</code> (its just my personal account).</p>

<p>It says <em>Account</em> so sounds like its not a user/permissions issue?
Do I have to enable my account for this service? I don't see any such option.</p>

<p>Also if login as a user (rather than root) - will I be able to see everything that was earlier created as root. I have now created a user and assigned admin and eks* permissions. <strong>I checked this</strong> <em>when I sign in as the user - I can see everything.</em></p>

<p>The aws cli was setup with root credentials (<em>I think</em>) - so do I have to go back and undo fix all this and just use this user.</p>

<p><strong>Update 1</strong><br>
I redid/restarted everything including user and awscli configure - just to make sure. But still the issue did not get resolved.</p>

<p>There is an option to <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html" rel="nofollow noreferrer">create the file manually</a> - that finally worked.</p>

<p>And I was able to : <code>kubectl get svc</code></p>

<p>NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.100.0.1           443/TCP   48m</p>

<p><strong>KUBECONFIG:</strong>  I had setup the env:KUBECONFIG </p>

<pre><code>$env:KUBECONFIG="C:\Users\sbaha\.kube\config-EKS-nginixClstr"
$Env:KUBECONFIG
C:\Users\sbaha\.kube\config-EKS-nginixClstr
kubectl config get-contexts
CURRENT   NAME   CLUSTER      AUTHINFO   NAMESPACE
*         aws    kubernetes   aws
kubectl config current-context
aws
</code></pre>

<p>My understanding is is I should see both the <code>aws</code> and my <code>EKS-nginixClstr</code> contexts but I only see <code>aws</code> - is this (also) a issue?</p>

<p>Next Step is to create and add worker nodes. I updated the node arn correctly in the .yaml file: <code>kubectl apply -f ~\.kube\aws-auth-cm.yaml</code><br>
<code>configmap/aws-auth configured</code>  <em>So this perhaps worked.</em></p>

<p>But next it fails:</p>

<blockquote>
  <p><code>kubectl get nodes</code>   <strong>No resources found in default namespace.</strong>  </p>
</blockquote>

<p>On AWS Console NodeGrp shows- <strong>Create Completed</strong>. Also on CLI <code>kubectl get nodes --watch</code>  - <em>it does not even return</em>.</p>

<p>So this this has to be debugged next- <em>(it never ends)</em></p>

<p><strong>aws-auth-cm.yaml</strong></p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::arn:aws:iam::xxxxx:role/Nginix-NodeGrpClstr-NodeInstanceRole-1SK61JHT0JE4
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
</code></pre>

<p>This problem was related to not having the correct version of eksctl - it must be at least 0.7.0. The documentation states this and I knew this, but initially whatever I did could not get beyond 0.6.0. The way you get it is to configure your AWS CLI to a region that supports EKS. Once you get 0.7.0 this issue gets resolved.<br>
Overall to make EKS work - you must have the same user both on console and CLI, and you must work on a region that supports EKS, and have correct eksctl version 0.7.0.</p>
