EKS Cluster Access Configuration

EKS Cluster Access Configuration A workflow diagram generated by Archify. 01 / Authentication setup 02 / Authorization & verification Set kubeconfig · update-kubeconfig · Authentication setup Set kubeconfig update-kubeconfig IAM principal · User · role · Authentication setup IAM principal User · role Access entry · Attach policy · Authentication setup Access entry Attach policy Define RBAC · Role rules · Authorization & verification Define RBAC Role rules RoleBinding · Bind subject · Authorization & verification RoleBinding Bind subject Test access · auth can-i · Authorization & verification Test access auth can-i 1 target 2 entry 3 narrow 4 bind 5 verify Legend Setup step Permissions AWS configuration

EKS access entries (recommended)

  • • aws eks create-access-entry registers an IAM principal with the cluster
  • • aws eks associate-access-policy attaches a policy such as AmazonEKSClusterAdminPolicy
  • • Access entries are managed through the AWS API, so they fit audit logs and IaC naturally

aws-auth ConfigMap (legacy)

  • • You edit mapRoles and mapUsers by hand in the aws-auth ConfigMap in kube-system
  • • ConfigMap size limits and hand-editing mistakes make it a poor choice for new clusters
  • • authenticationMode: API_AND_CONFIG_MAP lets both mechanisms coexist

Narrowing scope with RBAC

  • • Namespace-scoped Roles and RoleBindings split permissions per team
  • • Reach for ClusterRole and ClusterRoleBinding only when cluster-wide access is required
  • • kubectl auth can-i --as <principal> shows the effective permissions