<p>I would like to give a certain team access to the <code>system:masters</code> group in RBAC. My team (<code>AWSReservedSSO_Admin_xxxxxxxxxx</code> in example below) already has it and it works when I only add that one <code>rolearn</code>, but when I apply the configmap below with the additional <code>rolearn</code>, users under the <code>AWSReservedSSO_Dev_xxxxxxxxxx</code>role still get this error when trying to access the cluster: <code>error: You must be logged in to the server (Unauthorized)</code></p>
<p>(note: we are using AWS SSO, so the IAM roles are assumed):</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: ConfigMap
data:
  mapRoles: |
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/eks-node-group
      groups:
      - system:bootstrappers
      - system:nodes
      username: system:node:{{EC2PrivateDNSName}}
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Admin_xxxxxxxxxx
      groups:
      - system:masters
      username: admin
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Dev_xxxxxxxxxx
      groups:
        - system:masters
      username: admin
metadata:
  name: aws-auth
  namespace: kube-system
</code></pre>

<p>I'm not sure how you are assuming the roles ❓ and your configuration looks fine, but the reason could be that you are mapping the same user to two different roles. AWS IAM only allows a user to assume only one role at a time, <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html" rel="nofollow noreferrer">basically, as an AWS IAM user, you can't assume multiple IAM roles at the same time</a>.</p>
<p>You can try with different users and see it works for you.</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: ConfigMap
data:
  mapRoles: |
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/eks-node-group
      groups:
      - system:bootstrappers
      - system:nodes
      username: system:node:{{EC2PrivateDNSName}}
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Admin_xxxxxxxxxx
      groups:
      - system:masters
      username: admin
    - rolearn: arn:aws:iam::xxxxxxxxxxx:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Dev_xxxxxxxxxx
      groups:
        - system:masters
      username: admin2
metadata:
  name: aws-auth
  namespace: kube-system
</code></pre>
<p>The other aspect that you may be missing is the 'Trust Relationship' 🤝 in your <code>arn:aws:iam::xxxxxxxxxxx:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Dev_xxxxxxxxxx</code> role that allows <code>admin</code> to assume the role.</p>
<p><a href="https://i.stack.imgur.com/9cmml.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9cmml.png" alt="image1" /></a></p>
<p>✌️☮️</p>
