<p>I am trying to host an application in <strong>AWS Elastic Kubernetes Service(EKS)</strong>. I have configured the EKS cluster using the AWS Console. Configured the Node Group and added a Node to the EKS Cluster and everything is working fine.</p>
<p>In order to connect to the cluster, I had spin up an EC2 instance (Centos7) and configured the following:</p>
<p><strong>1. Installed docker, kubeadm, kubelet and kubectl.</strong><br />
<strong>2. Installed and configured AWS Cli V2.</strong></p>
<p>To authenticate to the EKS Cluster, I had attached an IAM role to the EC2 Instance having the following AWS managed policies:</p>
<p><strong>1. AmazonEKSClusterPolicy</strong><br />
<strong>2. AmazonEKSWorkerNodePolicy</strong><br />
<strong>3. AmazonEC2ContainerRegistryReadOnly</strong><br />
<strong>4. AmazonEKS_CNI_Policy</strong><br />
<strong>5. AmazonElasticContainerRegistryPublicReadOnly</strong><br />
<strong>6. EC2InstanceProfileForImageBuilderECRContainerBuilds</strong><br />
<strong>7. AmazonElasticContainerRegistryPublicFullAccess</strong><br />
<strong>8. AWSAppRunnerServicePolicyForECRAccess</strong><br />
<strong>9. AmazonElasticContainerRegistryPublicPowerUser</strong><br />
<strong>10. SecretsManagerReadWrite</strong></p>
<p>After this, I ran the following commands to connect to the EKS Cluster:<br />
<strong>1. aws sts get-caller-identity</strong><br />
<strong>2. aws eks update-kubeconfig --name eks-cluster --region ap-south-1</strong></p>
<p>When I ran <strong>kubectl cluster-info</strong> and <strong>kubectl get nodes</strong>, I got the following:</p>
<p><a href="https://i.stack.imgur.com/csrOT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/csrOT.png" alt="enter image description here" /></a></p>
<p><a href="https://i.stack.imgur.com/UbkSr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UbkSr.png" alt="enter image description here" /></a></p>
<p>However, when I try to run <strong>kubectl get namespaces</strong> I am getting the following error:</p>
<p><a href="https://i.stack.imgur.com/sA1T0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sA1T0.png" alt="enter image description here" /></a></p>
<p>I am getting the same kind of error when I try to create Namespaces in the EKS cluster.
Not sure what I'm missing here.</p>
<blockquote>
<p>Error from server (Forbidden): error when creating &quot;namespace.yml&quot;: namespaces is forbidden: User &quot;system:node:ip-172-31-43-129.ap-south-1.compute.internal&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope</p>
</blockquote>
<p>As an alternative, I tried to create a user with Administrative permission in IAM. Created <strong>AWS_ACCESS_KEY</strong> and <strong>AWS_SECRET_KEY_ID</strong>. Used <strong>aws configure</strong> to configure credentials within the EC2 Instance.</p>
<p>Ran the following commands:<br />
<strong>1. aws sts get-caller-identity</strong><br />
<strong>2. aws eks update-kubeconfig --name eks-cluster --region ap-south-1</strong><br />
<strong>3. aws eks update-kubeconfig --name eks-cluster --region ap-south-1 --role-arn arn:aws:iam::XXXXXXXXXXXX:role/EKS-Cluster-Role</strong></p>
<p>After running <strong>kubectl cluster-info --kubeconfig /home/centos/.kube/config</strong>, I got the following error:</p>
<p><a href="https://i.stack.imgur.com/TBhxF.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TBhxF.png" alt="enter image description here" /></a></p>
<blockquote>
<p>An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::XXXXXXXXXXXX:user/XXXXX is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXXXXXXXX:role/EKS-Cluster-Role</p>
</blockquote>
<p>Does anyone know how to resolve this issue??</p>

<p>Check your cluster role binding or user access to EKS cluster</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eks-console-dashboard-full-access-clusterrole
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes
  - namespaces
  - pods
  verbs:
  - get
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - statefulsets
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: eks-console-dashboard-full-access-binding
subjects:
- kind: Group
  name: eks-console-dashboard-full-access-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: eks-console-dashboard-full-access-clusterrole
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>Check the config map inside the cluster having proper user IAM mapping</p>
<pre><code>kubectl get configmap aws-auth -n kube-system -o yaml
</code></pre>
<p>Read more at :<a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-kubernetes-object-access-error/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/eks-kubernetes-object-access-error/</a></p>
