<p>I have created AWS EKS cluster since I have created using my AWS userID has been added to <code>system:masters</code> group. But when checked ConfigMap <code>aws-auth</code> I don't see my user ID. <strong>Why ?</strong></p>

<p>I had to give access to another user, so I have to assign appropriate AWS policies to the IAM user, then I edited the ConfigMap <code>aws-auth</code> with the following mapping </p>

<pre><code>mapUsers:
----
- userarn: arn:aws:iam::573504862059:user/abc-user  
  username: abc-user
  groups:
    - system:masters
</code></pre>

<p>So far I have understood when a user is part of <code>system:masters</code> group, this user has admin privileges on the cluster.</p>

<p>How can I <strong>add a new user who will have restricted privileges</strong> to a specific namespace? Do I have to do the same thing what I have done for the above user? If so then what group I should add the new user to?</p>

roy
<p>I would familiarize with <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes RBAC concepts</a></p>
<p>So you can create a <code>Role</code> since these are limited to a specific namespace.</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: my-namespace
  name: full-namespace
rules:
- apiGroups: [&quot;*&quot;] 
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>Then create a <code>RoleBinding</code>:</p>
<pre><code>$ kubectl create rolebinding my-namespace-binding --role=full-namespace --group=namespacegroup --namespace=my-namespace
</code></pre>
<p>Or <code>kubectl create -f</code> this:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-namespace-binding
  namespace: mynamespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: full-namespace
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: namespacegroup
</code></pre>
<p>Then on your ConfigMap:</p>
<pre><code>mapUsers:
----
- userarn: arn:aws:iam::573504862059:user/abc-user  
  username: abc-user
  groups:
    - namespacegroup
</code></pre>
