title: aws eks and aws sso RBAC authentication problem
body: <p>I have created a fresh AWS SSO (used internal IDP as identity source, so no use of Active Directory). <br>
  I am able to login to AWS CLI, AWS GUI, but <strong>unable</strong> to perform any kubectl ops.</p>
  <pre class="lang-sh prettyprint-override"><code>error: You must be logged in to the server (Unauthorized)
  </code></pre>
  <p>This has something to do with the RBAC I think as I am able to get EKS token via
  <code>aws eks get-token</code>.</p>
  <pre class="lang-sh prettyprint-override"><code>➜ cat ~/.aws/config
  
  [profile team-sso-admin]
  sso_start_url=https://team.awsapps.com/start
  sso_region=us-west-2
  sso_account_id=1111111111
  sso_role_name=AdministratorAccess
  region=us-west-2
  credential_process = aws-vault exec team-sso-admin --json
  
  
  ➜ aws-vault exec team-sso-admin --debug -- zsh --login
  ➜ env | grep AWS
  AWS_VAULT_PROMPT=pass
  AWS_VAULT_BACKEND=pass
  AWS_VAULT=team-sso-admin
  AWS_DEFAULT_REGION=us-west-2
  AWS_REGION=us-west-2
  AWS_ACCESS_KEY_ID=xxx
  AWS_SECRET_ACCESS_KEY=xxx
  AWS_SESSION_TOKEN=xxx
  AWS_SECURITY_TOKEN=yyy
  AWS_SESSION_EXPIRATION=2021-01-11T05:55:51Z
  AWS_SDK_LOAD_CONFIG=1
  
  ➜ aws sts get-caller-identity --output yaml 
  
  Account: '111111111111'
  Arn: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_6c71da2aa3076dfb/TestUser
  UserId: XXX:TestUser
  
  ➜ aws eks get-token --cluster-name team-shared-eks --role arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb
  
  {&quot;kind&quot;: &quot;ExecCredential&quot;, &quot;apiVersion&quot;: &quot;client.authentication.k8s.io/v1alpha1&quot;, &quot;spec&quot;: {}, &quot;status&quot;: {&quot;expirationTimestamp&quot;: &quot;2021-01-11T02:49:11Z&quot;, &quot;token&quot;: &quot;xxx&quot;}}
  
  </code></pre>
  <p><strong>kubeconfig</strong></p>
  <pre><code>config
  
  - name: arn:aws:eks:us-west-2:111111111111:cluster/team-shared-eks
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1alpha1
        args:
        - --region
        - us-west-2
        - eks
        - get-token
        - --cluster-name
        - team-shared-eks
        - --role
        - arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb
        command: aws
  </code></pre>
  <p><strong>aws-auth</strong></p>
  <pre><code>mapRoles: |
      - &quot;groups&quot;:
        - &quot;system:bootstrappers&quot;
        - &quot;system:nodes&quot;
        &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/team-shared-eks20210110051740674200000009&quot;
        &quot;username&quot;: &quot;system:node:{{EC2PrivateDNSName}}&quot;
      - &quot;groups&quot;:
        - &quot;system:master&quot;
        &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/team-saml-devops&quot;
        &quot;username&quot;: &quot;team-devops&quot;
      - &quot;groups&quot;:
        - &quot;system:master&quot;
        &quot;rolearn&quot;: &quot;arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb&quot;
        &quot;username&quot;: &quot;team-sso-devops&quot;
  
  </code></pre>
  <p><strong>clusterrole binding for team-sso-devops user</strong>:</p>
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    creationTimestamp: &quot;2021-01-11T01:37:51Z&quot;
    name: team:sso:devops
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: team-sso-devops
    namespace: default
  </code></pre>