<p>I created a aws eks using assume role api. Role A assume role B to performe create EKS api. I create the eks and specify that the EKS's cluster role is role C. As I know,the role C's arn will be stored in eks aws-auth configMap.</p>
<p>When A assume role C to access the created EKS, &quot;Failed to get namespaces: Unauthorized&quot; returned.</p>
<p>I always use assume role to invoke API. Does anyone know, whether aws-auth store role C's arn like 'arn:aws:iam::C:role/k8s-cluster-role' or eks store the role arn in aws-auth in another way.</p>

Kami Wan
<p>You have some misconception; The role that is stored in <strong>aws-auth configmap for system:masters group</strong> in your cluster is not the cluster role, but the iam principal that creates the cluster itself, <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html#:%7E:text=When%20you%20create%20an%20Amazon%20EKS%20cluster%2C%20the%20IAM%20principal%20that%20creates%20the%20cluster%20is%20automatically%20granted%20system%3Amasters%20permissions%20in%20the%20cluster%27s%20role%2Dbased%20access%20control%20(RBAC)%20configuration%20in%20the%20Amazon%20EKS%20control%20plane." rel="nofollow noreferrer">as per official doc</a>.</p>
<blockquote>
<p>When you create an Amazon EKS cluster, the IAM principal that creates the cluster is automatically granted system:masters permissions in the cluster's role-based access control (RBAC) configuration in the Amazon EKS control plane.</p>
</blockquote>
<p>From what you have written, if the sequence is right, and that assume-role approach you are following works properly, <strong>you should be able to query your cluster api resources with role-b not role-c</strong>, since b is the one you used to create the cluster. In your current setup, you are expecting role C to be able to access cluster resources, though you created with role b.</p>
