<p>I'm trying to understand how are managed RBAC authorizations for the first user that create an EKS cluster within AWS.<br />
Or in other words : How is the cluster creator mapped to the &quot;system:masters&quot; group within RBAC ?</p>
<p>I know this <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="noreferrer">doc</a> states : <em>&quot;When you create an Amazon EKS cluster, the IAM entity user or role, such as a federated user that creates the cluster, is automatically granted system:masters permissions in the cluster's RBAC configuration.&quot;</em><br />
And I understand how clusterrole <em>cluster-admin</em> and clusterrolebinding <em>cluster-admin</em> grants full admin rights to any members of the &quot;system:masters&quot; group.</p>
<p>What I can't figure out is how/where is the cluster creator user mapped to this group ? (the &quot;automatically granted&quot; part of the doc)</p>
<p><em>PS: I know that to add additionnal user/roles I'm supposed to use the aws-auth configmap, but this first user is not defined here and still has access to cluster.</em></p>
<p>If anyone can enlighten me please ?</p>
<p>Thanks in advance!</p>
<p>For the record I'm using a kubernetes 1.18 EKS cluster that was built with terraform via the community module <a href="https://github.com/terraform-aws-modules/terraform-aws-eks" rel="noreferrer">here</a> :</p>
<pre><code>module &quot;cluster&quot; {
  source  = &quot;terraform-aws-modules/eks/aws&quot;
  version = &quot;13.2.1&quot;

  cluster_version = &quot;1.18&quot;
  cluster_name    = &quot;memorandom-${local.id}&quot;
  vpc_id          = module.vpc.vpc_id
  subnets         = module.vpc.private_subnets

  write_kubeconfig = false
  manage_aws_auth  = true

  worker_groups = [
    {
      instance_type = &quot;t3.medium&quot;
      asg_max_size  = 3
      key_name      = &quot;pbenefice&quot;
    }
  ]

  tags = local.tags
}
</code></pre>

Pierre Benefice
<p>So I reached for AWS Support on this topic. And to summarize the answer was : &quot;<em>Most of what you are asking about is confidential information and cannot be disclosed.</em>&quot;.</p>
<p>I paste the full reply here :</p>
<hr />
<p>Thanks for reaching out to AWS Premium Support. My name is * and I understand you're curious about the implementation details of the cluster creator's being part of the system:masters group.</p>
<p>Most of what you are asking about is confidential information and cannot be disclosed.</p>
<p>However, I can tell you that the EKS Control Plane has an Authenticator component. You can enable logs for this as described here [1].</p>
<p>Personally, I like to think of that &quot;automatically granted&quot; part of the docs as an imaginary, read-only permanent object under the <code>mapUsers:</code> section of the aws-auth configmap. Imaginary because it's not implemented in the aws-auth configmap, but the permissions it is granted are the same as if it were there.  I've created an imaginary cluster-creator user object in the example below [2] that shows the effective implementation</p>
<p>[1]: Amazon EKS control plane logging - <a href="https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html</a></p>
<p>[2]: Example aws-auth configmap</p>
<pre><code>apiVersion: v1
data:
  mapRoles: |
    - rolearn: arn:aws:iam::111122223333:role/eksctl-my-cluster-nodegroup-standard-wo-NodeInstanceRole-1WP3NUE3O6UCF
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    # The way EKS currently bootstraps your cluster permissions, you can think of the cluster-creator having a
    # read-only permanent entry here - the effective permissions are the same
    - userarn: arn:aws:iam::111122223333:user/cluster-creator
      username: cluster-creator
      groups:
        - system:masters
    # In an actual aws-auth configmap, the cluster-creator entry above isn't there and
    # only the mapUsers below would be shown
    - userarn: arn:aws:iam::111122223333:user/admin
      username: admin
      groups:
        - system:masters
    - userarn: arn:aws:iam::111122223333:user/ops-user
      username: ops-user
      groups:
        - system:masters
</code></pre>
<p>The most important practical considerations regarding the cluster creator RBAC permissions are:</p>
<ul>
<li>the IAM entity (user or role) that created the cluster is always going to have admin privileges (system:masters permissions)</li>
<li>if IAM entity is deleted without other IAM entities being added with the necessary permissions to the aws-auth configmap - you have two options:
<ol>
<li>you must either recreate the IAM entity with the same name to regain access to your cluster, or</li>
<li>delete the cluster and create a new cluster using a new IAM entity</li>
</ol>
</li>
</ul>
<p>I know this probably wasn't all the information you'd hoped for, but I hope it helps satisfy part of your curiosity.
As I can't go into any real depth to answer your questions, I'll go ahead and resolve your case.
I hope you have a wonderful day and please feel free to reach out to us anytime.</p>
