<p>I have created a fresh AWS SSO (used internal IDP as identity source, so no use of Active Directory). <br>
I am able to login to AWS CLI, AWS GUI, but <strong>unable</strong> to perform any kubectl ops.</p>
<pre class="lang-sh prettyprint-override"><code>error: You must be logged in to the server (Unauthorized)
</code></pre>
<p>This has something to do with the RBAC I think as I am able to get EKS token via
<code>aws eks get-token</code>.</p>
<pre class="lang-sh prettyprint-override"><code>➜ cat ~/.aws/config

[profile team-sso-admin]
sso_start_url=https://team.awsapps.com/start
sso_region=us-west-2
sso_account_id=1111111111
sso_role_name=AdministratorAccess
region=us-west-2
credential_process = aws-vault exec team-sso-admin --json


➜ aws-vault exec team-sso-admin --debug -- zsh --login
➜ env | grep AWS
AWS_VAULT_PROMPT=pass
AWS_VAULT_BACKEND=pass
AWS_VAULT=team-sso-admin
AWS_DEFAULT_REGION=us-west-2
AWS_REGION=us-west-2
AWS_ACCESS_KEY_ID=xxx
AWS_SECRET_ACCESS_KEY=xxx
AWS_SESSION_TOKEN=xxx
AWS_SECURITY_TOKEN=yyy
AWS_SESSION_EXPIRATION=2021-01-11T05:55:51Z
AWS_SDK_LOAD_CONFIG=1

➜ aws sts get-caller-identity --output yaml 

Account: '111111111111'
Arn: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_6c71da2aa3076dfb/TestUser
UserId: XXX:TestUser

➜ aws eks get-token --cluster-name team-shared-eks --role arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb

{&quot;kind&quot;: &quot;ExecCredential&quot;, &quot;apiVersion&quot;: &quot;client.authentication.k8s.io/v1alpha1&quot;, &quot;spec&quot;: {}, &quot;status&quot;: {&quot;expirationTimestamp&quot;: &quot;2021-01-11T02:49:11Z&quot;, &quot;token&quot;: &quot;xxx&quot;}}

</code></pre>
<p><strong>kubeconfig</strong></p>
<pre><code>config

- name: arn:aws:eks:us-west-2:111111111111:cluster/team-shared-eks
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - us-west-2
      - eks
      - get-token
      - --cluster-name
      - team-shared-eks
      - --role
      - arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb
      command: aws
</code></pre>
<p><strong>aws-auth</strong></p>
<pre><code>mapRoles: |
    - &quot;groups&quot;:
      - &quot;system:bootstrappers&quot;
      - &quot;system:nodes&quot;
      &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/team-shared-eks20210110051740674200000009&quot;
      &quot;username&quot;: &quot;system:node:{{EC2PrivateDNSName}}&quot;
    - &quot;groups&quot;:
      - &quot;system:master&quot;
      &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/team-saml-devops&quot;
      &quot;username&quot;: &quot;team-devops&quot;
    - &quot;groups&quot;:
      - &quot;system:master&quot;
      &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb&quot;
      &quot;username&quot;: &quot;team-sso-devops&quot;

</code></pre>
<p><strong>clusterrole binding for team-sso-devops user</strong>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: &quot;2021-01-11T01:37:51Z&quot;
  name: team:sso:devops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: team-sso-devops
  namespace: default
</code></pre>

DmitrySemenov
<p>Option #1 - Try removing <code>aws-reserved/sso.amazonaws.com/$region/</code> from the role_arn</p>
<p>Option #2 - Use <a href="https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html" rel="nofollow noreferrer">aws-iam-authenticator</a>, the <a href="https://aws.amazon.com/blogs/opensource/integrating-ldap-ad-users-kubernetes-rbac-aws-iam-authenticator-project/#:%7E:text=Example" rel="nofollow noreferrer">official docs</a> provide a thorough example of how to use SSO and kubectl (kubeconfig)</p>
