<p>I have followed the documentation for spinning up an EKS cluster that says to make a service role with certain policies.</p>

<p><a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf</a></p>

<pre><code>To create your Amazon EKS service role
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. Choose Roles, then Create role.
3. Choose EKS from the list of services, then Allows Amazon EKS to manage your clusters on your behalf for your use case, then Next: Permissions.
4. Choose Next: Review.
5. For Role name, enter a unique name for your role, such as eksServiceRole, then choose Create role.
</code></pre>

<p>When I create a basic hello world app, it throws an AccessDenied error.</p>

<pre><code>Error creating load balancer (will retry): failed to ensure load balancer for service default/nginx:
AccessDenied: User: arn:aws:sts::*************:assumed-role/eks-service-role/************* is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::*************:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing
</code></pre>

<p>The two Policies that were added (AmazonEKSClusterPolicy, AmazonEKSServicePolicy) do not have the iam:CreateServiceLinkedRole action allowed. Are we supposed to add this outside of the policies defined in the guide? Or is this something that should be included in the EKS policies?</p>

dannyisonstackoverflow
<p>It seems that the EKS userguide assumes you have created load balancers in your AWS account prior to creating the EKS cluster, and thus have an existing <strong>AWSServiceRoleForElasticLoadBalancing</strong> service role in AWS IAM.  </p>

<p>As described in <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/elb-service-linked-roles.html#create-service-linked-role" rel="noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/elb-service-linked-roles.html#create-service-linked-role</a></p>

<pre><code>You don't need to manually create the AWSServiceRoleForElasticLoadBalancing role. Elastic Load Balancing creates this role for you when you create a load balancer.
</code></pre>

<p>EKS is attempting to do this for you, resulting in the access denied exception using the default policies.</p>

<p>Other options to explicitly create the service-linked role prior to EKS cluster creation include:</p>

<p>AWS CLI</p>

<pre><code>aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"
</code></pre>

<p>Terraform</p>

<pre><code>resource "aws_iam_service_linked_role" "elasticloadbalancing" {
  aws_service_name = "elasticloadbalancing.amazonaws.com"
}
</code></pre>

<p>Or, manually create a load balancer from the UI Console.</p>

<p>Regardless of provisioning options, you should know things will work when you see the following role in AWS IAM</p>

<pre><code>arn:aws:iam::&lt;ACCOUNT_ID&gt;:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing
</code></pre>
