<p>I am trying to map AWS IAM Role (Federated) to EKS RBAC, trying to follow <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/" rel="nofollow noreferrer">this</a> tutorial, but still get error</p>
<pre class="lang-sh prettyprint-override"><code>➜ kubectl edit configmap aws-auth -n kube-system

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  mapAccounts: |
    []
  mapRoles: |
    - &quot;groups&quot;:
      - &quot;system:bootstrappers&quot;
      - &quot;system:nodes&quot;
      &quot;rolearn&quot;: &quot;arn:aws:iam::xxx:role/edna-dev-eks200000005&quot;
      &quot;username&quot;: &quot;system:node:{{EC2PrivateDNSName}}&quot;
    - &quot;rolearn&quot;: &quot;arn:aws:iam::xxx:role/team-developers&quot;
      &quot;username&quot;: &quot;developer&quot;
      &quot;groups&quot;:
        - &quot;system:master&quot;
  mapUsers: |
    []
kind: ConfigMap
metadata:
  creationTimestamp: &quot;2020-06-11T19:40:47Z&quot;
  name: aws-auth
  namespace: kube-system
  resourceVersion: &quot;4627634&quot;
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: 137288f1-ae32-4a6f-b3d5-8dbd1da1e21d

</code></pre>
<pre class="lang-sh prettyprint-override"><code>➜ k get pods -n edna
Error from server (Forbidden): pods is forbidden: User &quot;developer&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;edna&quot;
</code></pre>
<p>Do I need to create RBAC for that User with the name &quot;developer&quot; and map all permissions?
If so what would be a proper way of doing it?</p>
<p>I have installed rakkess with kubectl krew, and if I am trying it with AWS security short-term credentials I get this:</p>
<pre><code>➜ k access-matrix -n edna           
NAME                                            LIST  CREATE  UPDATE  DELETE
bindings                                              ✖               
certificaterequests.cert-manager.io             ✖     ✖       ✖       ✖
certificates.cert-manager.io                    ✖     ✖       ✖       ✖
challenges.acme.cert-manager.io                 ✖     ✖       ✖       ✖
configmaps                                      ✖     ✖       ✖       ✖
controllerrevisions.apps                        ✖     ✖       ✖       ✖
cronjobs.batch                                  ✖     ✖       ✖       ✖
daemonsets.apps                                 ✖     ✖       ✖       ✖
deployments.apps                                ✖     ✖       ✖       ✖
endpoints                                       ✖     ✖       ✖       ✖
events                                          ✖     ✖       ✖       ✖
events.events.k8s.io                            ✖     ✖       ✖       ✖
horizontalpodautoscalers.autoscaling            ✖     ✖       ✖       ✖
ingresses.extensions                            ✖     ✖       ✖       ✖
ingresses.networking.k8s.io                     ✖     ✖       ✖       ✖
issuers.cert-manager.io                         ✖     ✖       ✖       ✖
jobs.batch                                      ✖     ✖       ✖       ✖
leases.coordination.k8s.io                      ✖     ✖       ✖       ✖
limitranges                                     ✖     ✖       ✖       ✖
localsubjectaccessreviews.authorization.k8s.io        ✖               
networkpolicies.networking.k8s.io               ✖     ✖       ✖       ✖
orders.acme.cert-manager.io                     ✖     ✖       ✖       ✖
persistentvolumeclaims                          ✖     ✖       ✖       ✖
poddisruptionbudgets.policy                     ✖     ✖       ✖       ✖
pods                                            ✖     ✖       ✖       ✖
podtemplates                                    ✖     ✖       ✖       ✖
replicasets.apps                                ✖     ✖       ✖       ✖
replicationcontrollers                          ✖     ✖       ✖       ✖
resourcequotas                                  ✖     ✖       ✖       ✖
rolebindings.rbac.authorization.k8s.io          ✖     ✖       ✖       ✖
roles.rbac.authorization.k8s.io                 ✖     ✖       ✖       ✖
secrets                                         ✖     ✖       ✖       ✖
serviceaccounts                                 ✖     ✖       ✖       ✖
services                                        ✖     ✖       ✖       ✖
statefulsets.apps                               ✖     ✖       ✖       ✖
</code></pre>
<p>Thanks,
Dmitry</p>

DmitrySemenov
<p>You need to have role and rolebinding to list pods for that namespace</p>
<ol>
<li><p>Create role</p>
<p><code>kubectl create role developer --verb=get,list,watch --resource=pods,pods/status --namespace=edna</code></p>
</li>
<li><p>Rolebinding for that role</p>
<p><code>kubectl create rolebinding developer-binding --role=developer --user=developer --serviceaccount=edna:default -n edna</code></p>
</li>
<li><p>After this run this command to check if you can get access or not.</p>
<p><code>kubectl auth can-i get pods -n edna --as developer</code> and this command will return <code>yes</code> then your problem fixed.</p>
</li>
</ol>
<p>For more information refer this document</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding</a></p>
