<p>Our system has EKS kubernetes clusters. We manage them from EC2 instance &quot;bastion hosts&quot; where we ssh in, configure our credentials, and use kubectl to manage the cluster.</p>
<p>We do <em>not</em> want to continue having to manually configure our credentials on the EC2 host.</p>
<p>So, I am trying to associate an EC2 Instance profile with the EC2 host with appropriate permissions to manage the cluster. However, it does not work.</p>
<p>The EC2 instance has an IAM instance profile that is associated with a role that contains this policy (full EKS permissions)</p>
<pre><code>{
    &quot;Sid&quot;: &quot;2&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;eks:*&quot;
    ],
    &quot;Resource&quot;: &quot;*&quot;
}
</code></pre>
<p>So, when I run the following commands, I expect to be able to list the active services on EKS:</p>
<pre><code>[ec2-user@ip-10-0-0-72 ~]$ aws eks update-kubeconfig --name my_eks_cluster_name
[ec2-user@ip-10-0-0-72 ~]$ kubectl get svc
error: the server doesn't have a resource type &quot;svc&quot;
</code></pre>
<p>The error implies that I don't have permission. I proved this by configuring some AWS credentials on the host:</p>
<pre><code>[ec2-user@ip-10-0-0-72 ~]$ export AWS_ACCESS_KEY_ID=...
[ec2-user@ip-10-0-0-72 ~]$ export AWS_SECRET_ACCESS_KEY=...
[ec2-user@ip-10-0-0-72 ~]$ export AWS_SESSION_TOKEN=...
</code></pre>
<p>now, I try to list svc:</p>
<pre><code>[ec2-user@ip-10-0-0-72 ~]$ kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   &lt;none&gt;        443/TCP   85d
</code></pre>
<p>it works</p>
<p>Why is the IAM instance role not sufficient to allow me to manage my EKS cluster via kubectl?</p>

<p>Thanks to @jordanm for pointing out that EKS uses a configmap to handle authorization.</p>
<p>I was able to edit the configmap, adding an entry to map the EC2 instance profile's IAM role, <code>arn:aws:iam::111111111111:role/eks_management_host_jw_jw</code>, to the kubernetes <code>system:masters</code> group (admins)</p>
<pre><code># Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::111111111111:role/eks_node_jw_jw
      username: system:node:{{EC2PrivateDNSName}}
    - groups:  # &lt;-- I added this
      - system:masters
      rolearn: arn:aws:iam::111111111111:role/eks_management_host_jw_jw
      username: system:admin
kind: ConfigMap
metadata:
  # ...
</code></pre>
