<p>Starting from a ~empty AWS account, I am trying to follow <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html</a> </p>

<p>So that meant I created a VPS stack, then installed aws-iam-authenticator, awscli and kubectl, then created an IAM user with Programmatic access and AmazonEKSAdminPolicy directly
attached.</p>

<p>Then I used the website to create my EKS cluster and used <code>aws configure</code> to set the access key and secret of my IAM user.</p>

<p><code>aws eks update-kubeconfig --name wr-eks-cluster</code> worked fine, but:</p>

<pre><code>kubectl get svc
error: the server doesn't have a resource type "svc"
</code></pre>

<p>I continued anyway, creating my worker nodes stack, and now I'm at a dead-end with:</p>

<pre><code>kubectl apply -f aws-auth-cm.yaml
error: You must be logged in to the server (the server has asked for the client to provide credentials)
</code></pre>

<p><code>aws-iam-authenticator token -i &lt;my cluster name&gt;</code> seems to work fine.</p>

<p>The thing I seem to be missing is that when you create the cluster you specify an IAM role, but when you create the user (according to the guide) you attach a policy. How is my user supposed to have access to this cluster?</p>

<p>Or ultimately, how do I proceed and gain access to my cluster using kubectl?</p>

<ol>
<li>As mentioned <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="noreferrer">in docs</a>, the AWS IAM user created EKS cluster automatically receives <code>system:master</code> permissions, and it's enough to get <code>kubectl</code> working. You need to use this user credentials (<code>AWS_ACCESS_KEY_ID</code> and <code>AWS_SECRET_ACCESS_KEY</code>) to access the cluster. In case you didn't create a specific IAM user to create a cluster, then you probably created it using root AWS account. In this case, you can use root user credentials (<a href="https://docs.aws.amazon.com/en_us/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_add-key" rel="noreferrer">Creating Access Keys for the Root User</a>).</li>
<li>The main magic is inside <code>aws-auth</code> ConfigMap in your cluster – it contains IAM entities -> kubernetes ServiceAccount mapping.</li>
</ol>

<p>I'm not sure about how do you pass credentials for the <code>aws-iam-authenticator</code>:</p>

<ul>
<li>If you have <code>~/.aws/credentials</code> with <code>aws_profile_of_eks_iam_creator</code> then you can try <code>$ AWS_PROFILE=aws_profile_of_eks_iam_creator kubectl get all --all-namespaces</code></li>
<li>Also, you can use environment variables <code>$ AWS_ACCESS_KEY_ID=XXX AWS_SECRET_ACCESS_KEY=YYY AWS_DEFAULT_REGION=your-region-1 kubectl get all --all-namespaces</code></li>
</ul>

<p>Both of them should work, because <code>kubectl ...</code> will use generated <code>~/.kube/config</code> that contains <code>aws-iam-authenticator token -i cluster_name</code> command. <code>aws-iam-authenticator</code> uses environment variables or <code>~/.aws/credentials</code> to give you a token.</p>

<p>Also, <a href="https://stackoverflow.com/a/51181905/3838486">this answer</a> may be useful for the understanding of the first EKS user creation.</p>
