<p>We have two clusters, named:</p>

<ol>
<li>MyCluster (created by me)</li>
<li>OtherCluster (not created by me)</li>
</ol>

<p>Where "me" is my own AWS IAM user.</p>

<p>I am able to manage the cluster I created, using kubectl:</p>

<pre><code>&gt;&gt;&gt; aws eks update-kubeconfig --name MyCluster –profile MyUser
&gt;&gt;&gt; kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   &lt;none&gt;        443/TCP   59d
</code></pre>

<p>But, I cannot manage the “OtherCluster” cluster (that was not created by me):</p>

<pre><code>&gt;&gt;&gt; aws eks update-kubeconfig --name OtherCluster --profile MyUser
&gt;&gt;&gt; kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
error: the server doesn't have a resource type "svc"
</code></pre>

<p>After reading the feedback of some people experiencing the same issue in this <a href="https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/157" rel="nofollow noreferrer">github issue</a>, I tried doing this under the context of the user who originally created the "OtherCluster".</p>

<p>I accomplished this by editing “~/.kube/config”, adding a “AWS_PROFILE” value at “users.user.env”. The profile represents the user who created the cluster.</p>

<p>~/.kube/config:</p>

<pre><code>…
users
- name: OtherCluster
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - -i
      - OtherCluster
      command: aws-iam-authenticator
      env:
      - name: AWS_PROFILE
        value: OTHER_USER_PROFILE
…
</code></pre>

<p>This worked:</p>

<pre><code># ~/.kube/config is currently pointing to OtherCluster

&gt;&gt;&gt; kubectl get svc 
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   &lt;none&gt;        443/TCP   1d
</code></pre>

<p>It is obviously not ideal for me to impersonate another person when I am managing the cluster. I would prefer to grant my own user access to manage the cluster via kubectl.
Is there any way I can grant permission to manage the cluster to a user other than the original creator? This seems overly restrictive</p>

James Wierzba
<p>When an Amazon EKS cluster is created, the IAM entity (user or role) that creates the cluster is added to the Kubernetes RBAC authorization table as the administrator. <strong>Initially</strong>, only that IAM user can make calls to the Kubernetes API server using kubectl. </p>

<p>To grant additional AWS users the ability to interact with your cluster, you must edit the <code>aws-auth</code> ConfigMap within Kubernetes, adding a new <code>mapUsers</code> entry for your ConfigMap. <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">This EKS doc</a> covers all the process.</p>

<blockquote>
  <p>To add an IAM user: add the user details to the mapUsers section of
  the ConfigMap, under data. Add this section if it does not already
  exist in the file. Each entry supports the following parameters:</p>
  
  <ul>
  <li>userarn: The ARN of the IAM user to add.</li>
  <li>username: The user name within Kubernetes to map to the IAM user. By    default, the user name is the ARN of the IAM user.</li>
  <li>groups: A list of groups within Kubernetes to which the user is    mapped to. For more information, see Default Roles and Role Bindings<br>
  in the Kubernetes documentation.</li>
  </ul>
</blockquote>

<p>Example:</p>

<pre><code>apiVersion: v1
data:
  mapRoles: |
    - rolearn: arn:aws:iam::555555555555:role/devel-worker-nodes-NodeInstanceRole-74RF4UBDUKL6
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    - userarn: arn:aws:iam::555555555555:user/my-new-admin-user
      username: my-new-admin-user
      groups:
        - system:masters
</code></pre>
