AWS Tutorials: How to manually grant your Federated IAM User access to kubectl in AWS EKS?

Thanks for pointing that out! The AWS EKS authentication method has changed in 2026, and the aws-auth ConfigMap is no longer used for adding IAM roles. Instead, IAM Access entries are managed under the Access tab in the AWS Console.

Here are the updated steps to manually grant your Federated IAM User access to kubectl in AWS EKS.

✅ Step 1: Identify Your Federated IAM Role

1. Go to AWS Console → IAM → Roles
2. Find the IAM Role associated with your Federated User (SSO/Federated Access).
3. Copy the Role ARN, which looks like: arn:aws:iam::329599659644:role/<Federated-Role-Name>

✅ Step 2: Add the Federated IAM Role in EKS “Access” Tab

1. Go to AWS Console → EKS → Your Cluster (evp-dev-eks)
2. Click the Access tab.
3. Click “Add IAM access entry”.
4. Select IAM Role.
5. Paste your Federated Role ARN (arn:aws:iam::329599659644:role/<Federated-Role-Name>).
6. Assign a Cluster Role:
   • Choose Administrator Access (Full kubectl permissions) → system:masters
   • Alternatively, choose Read-Only Access (View-Only role).
7. Click “Save Changes”.

✅ Step 3: Attach Required IAM Policies to the Federated Role

Your Federated IAM Role must have the following policies:

Attach Policies to Your Role

1. Go to AWS Console → IAM → Roles → <Federated-Role-Name>
2. Click Permissions → Attach Policies
3. Add the following policies:
   • ✅ AmazonEKSClusterPolicy
   • ✅ AmazonEKSWorkerNodePolicy
   • ✅ AmazonEKSServicePolicy
   • ✅ eks:AccessKubernetesApi
4. Click Attach Policy.

✅ Step 4: Update kubeconfig for Federated User

Once IAM access is set, update your local kubeconfig to reflect the changes:

aws eks update-kubeconfig --name evp-dev-eks --region ap-northeast-1 --role-arn arn:aws:iam::329599659644:role/<Federated-Role-Name>
Code language: HTML, XML (xml)

Then test access:

kubectl get nodes
Code language: JavaScript (javascript)

✅ Step 5: Verify Access

If kubectl get nodes still fails, check:

kubectl auth can-i list nodes --all-namespaces --verbose
Code language: PHP (php)

• If “yes”, you have access.
• If “no”, IAM role or permissions need adjustment.

🎯 Summary of AWS 2026 EKS Changes

✅ The aws-auth ConfigMap is no longer used.
✅ IAM roles/users are now added via EKS “Access” Tab.
✅ Federated users need IAM role-based access via IAM access entries.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.