<p>What is the relationship between the role my principal is using and the RBAC  in k8s?</p>
<p>Specifically, when I do <code>kubectl describe -n kube-system configmap/aws-auth</code> I see this role: <code>myAmazonEKSNodeRole</code> as described <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-launch-workers" rel="nofollow noreferrer">here</a>.</p>
<p>But when I look in the role permission in AWS IAM console, I expect to see this:</p>
<pre><code>[jenia@archlinux ibn-battuta]$ kubectl get rolebindings -A
NAMESPACE     NAME                                                           ROLE                                                  AGE
kube-public   system:controller:bootstrap-signer                             Role/system:controller:bootstrap-signer               11d
kube-system   eks-vpc-resource-controller-rolebinding                        Role/eks-vpc-resource-controller-role                 11d
kube-system   eks:addon-manager                                              Role/eks:addon-manager                                11d
kube-system   eks:authenticator                                              Role/eks:authenticator                                11d
kube-system   eks:az-poller                                                  Role/eks:az-poller                                    11d
kube-system   eks:certificate-controller                                     Role/eks:certificate-controller                       11d
kube-system   eks:cloud-controller-manager:apiserver-authentication-reader   Role/extension-apiserver-authentication-reader        11d
kube-system   eks:fargate-manager                                            Role/eks:fargate-manager                              11d
kube-system   eks:k8s-metrics                                                Role/eks:k8s-metrics                                  11d
kube-system   eks:node-manager                                               Role/eks:node-manager                                 11d
kube-system   eks:service-operations                                         Role/eks:service-operations-configmaps                11d
kube-system   system::extension-apiserver-authentication-reader              Role/extension-apiserver-authentication-reader        11d
kube-system   system::leader-locking-kube-controller-manager                 Role/system::leader-locking-kube-controller-manager   11d
kube-system   system::leader-locking-kube-scheduler                          Role/system::leader-locking-kube-scheduler            11d
kube-system   system:controller:bootstrap-signer                             Role/system:controller:bootstrap-signer               11d
kube-system   system:controller:cloud-provider                               Role/system:controller:cloud-provider                 11d
kube-system   system:controller:token-cleaner                                Role/system:controller:token-cleaner                  11d
</code></pre>
<p>But instead in the IAM console I see this:</p>
<pre><code>                &quot;ecr:GetAuthorizationToken&quot;,
                &quot;ecr:BatchCheckLayerAvailability&quot;,
                &quot;ecr:GetDownloadUrlForLayer&quot;,
                &quot;ecr:GetRepositoryPolicy&quot;,
                &quot;ecr:DescribeRepositories&quot;,
                &quot;ecr:ListImages&quot;,
                &quot;ecr:DescribeImages&quot;,
                &quot;ecr:BatchGetImage&quot;,
                &quot;ecr:GetLifecyclePolicy&quot;,
                &quot;ecr:GetLifecyclePolicyPreview&quot;,
                &quot;ecr:ListTagsForResource&quot;,
                &quot;ecr:DescribeImageScanFindings&quot;
</code></pre>
<p>There seems to be no connection whatsoever between the permissions in the IAM console for the CLI role <code>myAmazonEKSNodeRole</code> and the RBAC in k8s. This is puzzling. How do I control which permission a specific IAM role has in my k8s cluster?</p>

Jenia Ivanov
<p>The aws-auth ConfigMap maintains a mapping between IAM principles and Kubernetes RBAC groups. Granting access to EKS clusters is a multi-step process.</p>
<ol>
<li>Create a cluster role or a role that defines the RBAC permissions</li>
<li>Create a cluster role binding or role binding that associates the cluster role or role with an RBAC group</li>
<li>Add an entry to the aws-auth ConfigMap that maps an IAM principle to an RBAC group, e.g. system:masters</li>
</ol>
<p>While its possible to update the aws-auth ConfigMap manually, I recommend using eksctl or the aws-iam-authenticator instead because you're less likely to corrupt your aws-auth ConfigMap with those tools.</p>
<p>The role you're looking at in the AWS console is the IAM role assigned to the worker node. It needs those permissions to fetch images from ECR.</p>
