<p>My requirement is to provide read-only access to all objects of Kubernetes in the EKS cluster to certain IAM users. These objects can be nodes, pods, services, replica sets, daemonset, etc.</p>
<p>I referred the docs but haven't found what is the best way.
What I did is create an IAM role with the name <code>read-only-access-eks</code> which has the policy <code>ReadOnlyAccess</code> attached to it. This is a managed policy.</p>
<p>I attached this policy to one of the IAM users on my team, but when he logged in to the EKS cluster, he got the below error:</p>
<blockquote>
<p>Error loading GenericResourceCollection/namespaces</p>
<p>namespaces is forbidden: User &quot;xxxxx&quot; cannot list
resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope</p>
</blockquote>
<p>How to fix this?</p>
<p><strong>UPDATE 1</strong></p>
<p>here is the output of</p>
<pre><code>kubectl edit -n kube-system configmap/aws-auth
</code></pre>
<p>output</p>
<pre><code># Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::02334:role/AmazonEKSVPCCNIRole
      username: system:node:{{EC2PrivateDNSName}}
  mapUsers: |
    - userarn: arn:aws:iam::02334:user/user1
      username: user1
      groups:
        - view
    - userarn: arn:aws:iam::02334:user/user2
      username: user2
      groups:
        - system:masters
kind: ConfigMap
metadata:
  creationTimestamp: &quot;2023-04-13T14:27:20Z&quot;
  name: aws-auth
  namespace: kube-system
  resourceVersion: &quot;357187&quot;
  uid: 58a534550-bcc-44f-2d6-15435435
</code></pre>
<p>I see that the user1 is a part of the view group, then still he is getting an access denied error. Please help.</p>

user2315104
<p>You need to modify the <code>aws-auth configmap</code> (in the <code>kube-system</code> namespace) and add the <code>mapUsers</code> section to add the IAM user you need to provide with read-only access to see/view (most) objects in the Cluster.</p>
<p>The configuration you need to add shall look something like this:</p>
<pre><code>data:
  mapUsers: |
    - userarn: arn:aws:iam::123456789:user/read-only-access-eks
      username: read-only-access-eks
      groups:
        - view
</code></pre>
<p>where <code>view</code> is the default <code>ClusterRole</code> which allows read-only access to see most objects in a namespace. Read more about it <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles" rel="nofollow noreferrer">here</a></p>
<p><a href="https://www.agilepartner.net/en/adding-users-to-your-eks-cluster/" rel="nofollow noreferrer">Here</a> is another link that should guide you to map an IAM user arn to a pre-defined <code>ClusterRole</code>.</p>
<p>Some <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">documentation</a> around <code>aws-auth ConfigMap</code> in an eks cluster.</p>
<p>Hope it helps!</p>
