<p>Aim is to create a read-only user for production namespace for my EKS cluster. However, I see the user has full access. As I am new to EKS and Kubernetes, please let me know the error that I have injected.</p>

<p>I have created an IAM user without any permission added. ARN is: <code>arn:aws:iam::460764xxxxxx:user/eks-prod-readonly-user</code>. Also, I have noted down the access key id and secret access key -</p>

<pre><code>aws_access_key_id= AKIAWWxxxxxxxxxxxxx
aws_secret_access_key= lAbtyv3zlbAMPxym8Jktal+xxxxxxxxxxxxxxxxxxxx
</code></pre>

<p>Then, I have created the production namespace, role, and role binding as follows –</p>

<pre><code>ubuntu@ip-172-16-0-252:~$ sudo kubectl create namespace production

ubuntu@ip-172-16-0-252:~$ cat role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: production
  name: prod-viewer-role
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["*"]  
  verbs: ["get", "list", "watch"]

ubuntu@ip-172-16-0-252:~$ sudo kubectl apply -f role.yaml

ubuntu@ip-172-16-0-252:~$ cat rolebinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: prod-viewer-binding
  namespace: production
subjects:
- kind: User
  name: eks-prod-readonly-user
  apiGroup: ""
roleRef:
  kind: Role
  name: prod-viewer-role
  apiGroup: ""

ubuntu@ip-172-16-0-252:~$ sudo kubectl apply -f rolebinding.yaml
</code></pre>

<p>Then, we have added the newly created user to aws-auth configuration map and have applied the changes -</p>

<pre><code>ubuntu@ip-172-16-0-252:~$ sudo kubectl -n kube-system get configmap aws-auth -o yaml &gt; aws-auth-configmap.yaml
ubuntu@ip-172-16-0-252:~$ vi aws-auth-configmap.yaml
</code></pre>

<p>The following section is added under ‘mapUsers’ –</p>

<pre><code>- userarn: arn:aws:iam::460764xxxxxx:user/eks-prod-readonly-user
      username: eks-prod-readonly-user
      groups:
        - prod-viewer-role

ubuntu@ip-172-16-0-252:~$ sudo kubectl apply -f aws-auth-configmap.yaml
</code></pre>

<p>Now, I include this user details as a new section inside AWS credential file ( <code>~/.aws/credentials</code> ) so that this user can be authenticated to API server of Kubernetes -</p>

<pre><code>[eksprodreadonlyuser]
aws_access_key_id= AKIAWWxxxxxxxxxxxxx
aws_secret_access_key= lAbtyv3zlbAMPxym8Jktal+xxxxxxxxxxxxxxxxxxxx
region=eu-west-2
output=json
</code></pre>

<p>I activate this AWS profile -</p>

<pre><code>ubuntu@ip-172-16-0-252:~$ export AWS_PROFILE="eksprodreadonlyuser"
ubuntu@ip-172-16-0-252:~$ aws sts get-caller-identity
</code></pre>

<p>We see the correct user ARN in the output of get-caller-identity command.</p>

<p>While trying to see pods of default namespace, it works. Ideally it shall not as the user is given access on the production namespace only -</p>

<pre><code>ubuntu@ip-172-16-0-252:~$ sudo kubectl get pods
NAME                              READY   STATUS    RESTARTS   AGE
test-autoscaler-697b95d8b-5wl5d   1/1     Running   0          7d20h
ubuntu@ip-172-16-0-252:~$
</code></pre>

<p>Let know pointers to resolve. Thanks in advance!</p>

<p>Please try first to <code>export</code> all your credentials to the terminal as environment variables instead of using profiles:</p>
<pre><code>export AWS_ACCESS_KEY_ID=XXX
export AWS_SECRET_ACCESS_KEY=XXX
export AWS_DEFAULT_REGION=us-east-2
</code></pre>
<p>This is just for debugging and making sure that the problem is not in your configuration.</p>
<p>If this doesn't work - try using the configuration below.</p>
<p>ClusterRoleBinding and ClusterRole:</p>
<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: eks-ro-user-binding
subjects:
- kind: User
  name: eks-ro-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: eks-ro-user-cluster-role
  apiGroup: rbac.authorization.k8s.io

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: eks-ro-user-cluster-role
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
</code></pre>
<p>AWS auth config map (after you created an IAM user):</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::&lt;account-id&gt;:role/eks-node-group-role
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    - userarn: arn:aws:iam::&lt;account-id&gt;:user/eks-ro-user
      username: eks-ro-user
</code></pre>
