<p>I am trying to host an application in <strong>AWS Elastic Kubernetes Service(EKS)</strong>. I have configured the EKS cluster using the AWS Console using an <strong>IAM user (user1)</strong>. Configured the Node Group and added a Node to the EKS Cluster and everything is working fine.</p>
<p>In order to connect to the cluster, I had spin up an EC2 instance (Centos7) and configured the following:</p>
<p><strong>1. Installed docker, kubeadm, kubelet and kubectl.</strong><br />
<strong>2. Installed and configured AWS Cli V2.</strong></p>
<p>I had used the <strong>AWS_ACCESS_KEY_ID</strong> and <strong>AWS_SECRET_KEY_ID</strong> of user1 to configure AWS Cli from within the EC2 Instance in order to connect to the cluster using kubectl.</p>
<p>I ran the below commands in order to connect to the cluster as user1:</p>
<p><strong>1. aws sts get-caller-identity</strong><br />
<strong>2. aws eks update-kubeconfig --name trojanwall --region ap-south-1</strong></p>
<p>I am able to do each and every operations in the EKS cluster as user1.</p>
<p>However, I have now create a new user named '<strong>user2</strong>' and I have replaced the current <strong>AWS_ACCESS_KEY_ID</strong> and <strong>AWS_SECRET_KEY_ID</strong> with that of user2. Did the same steps and when I try to run '<strong>kubectl get pods</strong>', I am getting the following error:</p>
<p><a href="https://i.stack.imgur.com/P7PBI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/P7PBI.png" alt="enter image description here" /></a></p>
<blockquote>
<p>error: You must be logged in to the server (Unauthorized)</p>
</blockquote>
<p>Result after running <strong>kubectl describe configmap -n kube-system aws-auth</strong> as user1:</p>
<pre><code>Name:         aws-auth
Namespace:    kube-system
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;

Data
====
mapRoles:
----
- groups:
  - system:bootstrappers
  - system:nodes
  rolearn: arn:aws:iam::XXXXXXXXXXXX:role/AWS-EC2-Role
  username: system:node:{{EC2PrivateDNSName}}


BinaryData
====

Events:  &lt;none&gt;
</code></pre>
<p>Does anyone know how to resolve this?</p>

arjunbnair
<p>When you create an EKS cluster, only the user that created a cluster has access to it. In order to allow someone else to access the cluster, you need to add that user to the aws-auth. To do this, in your <code>data</code> section, add</p>
<pre><code>mapUsers: |
  - userarn: arn:was:iam::&lt;your-account-id&gt;:user/&lt;your-username&gt;
    username: &lt;your-username&gt;
    groups:
      - systems:masters
</code></pre>
<p>You can use different groups, based on the rights you want to give to that user.</p>
<p>If you don't already have a config map on your machine:</p>
<ol>
<li>Download the config map <code>curl -o aws-auth-cm.yaml https://amazon-eks.s3.us-west-2.amazonaws.com/cloudformation/2020-10-29/aws-auth-cm.yaml</code></li>
<li>Replace default values with your values (role arn, username, account id...)</li>
<li>add the mapUsers section as described above</li>
<li>from terminal execute <code>kubectl apply -f aws-auth-cm.yaml</code></li>
</ol>
<p>You can also follow steps from the <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">documentation</a>  (it's more detailed)</p>
