{"id":48609,"date":"2025-02-26T04:55:42","date_gmt":"2025-02-26T04:55:42","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=48609"},"modified":"2026-02-21T07:26:20","modified_gmt":"2026-02-21T07:26:20","slug":"aws-tutorials-how-to-manually-grant-your-federated-iam-user-access-to-kubectl-in-aws-eks","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/aws-tutorials-how-to-manually-grant-your-federated-iam-user-access-to-kubectl-in-aws-eks\/","title":{"rendered":"AWS Tutorials: How to manually grant your Federated IAM User access to kubectl in AWS EKS?"},"content":{"rendered":"\n

Thanks for pointing that out! The AWS EKS authentication method has changed in 2026<\/strong>, and the aws-auth<\/code> ConfigMap is no longer used<\/strong> for adding IAM roles. Instead, IAM Access entries<\/strong> are managed under the Access<\/strong> tab in the AWS Console.<\/p>\n\n\n\n

Here are the updated steps<\/strong> to manually grant your Federated IAM User<\/strong> access to kubectl<\/code> in AWS EKS.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\n\n\n\n

\u2705 Step 1: Identify Your Federated IAM Role<\/strong><\/h2>\n\n\n\n
    \n
  1. Go to AWS Console \u2192 IAM \u2192 Roles<\/strong><\/li>\n\n\n\n
  2. Find the IAM Role<\/strong> associated with your Federated User (SSO\/Federated Access).<\/li>\n\n\n\n
  3. Copy the Role ARN<\/strong>, which looks like: arn:aws:iam::329599659644:role\/<Federated-Role-Name><\/code><\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n
    \"\"<\/figure>\n\n\n\n

    \u2705 Step 2: Add the Federated IAM Role in EKS “Access” Tab<\/strong><\/h2>\n\n\n\n
      \n
    1. Go to AWS Console \u2192 EKS \u2192 Your Cluster (evp-dev-eks<\/code>)<\/strong><\/li>\n\n\n\n
    2. Click the Access<\/strong> tab.<\/li>\n\n\n\n
    3. Click “Add IAM access entry”<\/strong>.<\/li>\n\n\n\n
    4. Select IAM Role<\/strong>.<\/li>\n\n\n\n
    5. Paste your Federated Role ARN<\/strong> (arn:aws:iam::329599659644:role\/<Federated-Role-Name><\/code>).<\/li>\n\n\n\n
    6. Assign a Cluster Role<\/strong>:\n
        \n
      • Choose Administrator Access<\/strong> (Full kubectl<\/code> permissions<\/strong>) \u2192 system:masters<\/code><\/li>\n\n\n\n
      • Alternatively, choose Read-Only Access<\/strong> (View-Only<\/code> role).<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • Click “Save Changes”<\/strong>.<\/li>\n<\/ol>\n\n\n\n
        \n\n\n\n

        \u2705 Step 3: Attach Required IAM Policies to the Federated Role<\/strong><\/h2>\n\n\n\n

        Your Federated IAM Role must<\/strong> have the following policies:<\/p>\n\n\n\n

        Attach Policies to Your Role<\/strong><\/h3>\n\n\n\n
          \n
        1. Go to AWS Console \u2192 IAM \u2192 Roles \u2192 <Federated-Role-Name><\/code><\/strong><\/li>\n\n\n\n
        2. Click Permissions \u2192 Attach Policies<\/strong><\/li>\n\n\n\n
        3. Add the following policies:\n
            \n
          • \u2705 AmazonEKSClusterPolicy<\/code><\/li>\n\n\n\n
          • \u2705 AmazonEKSWorkerNodePolicy<\/code><\/li>\n\n\n\n
          • \u2705 AmazonEKSServicePolicy<\/code><\/li>\n\n\n\n
          • \u2705 eks:AccessKubernetesApi<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
          • Click Attach Policy<\/strong>.<\/li>\n<\/ol>\n\n\n\n
            \n\n\n\n

            \u2705 Step 4: Update kubeconfig<\/code> for Federated User<\/strong><\/h2>\n\n\n\n

            Once IAM access is set, update your local kubeconfig<\/code> to reflect the changes:<\/p>\n\n\n

            aws eks update-kubeconfig --name evp-dev-eks --region ap-northeast-1 --role-arn arn:aws:iam::329599659644:role\/<Federated-Role-Name<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
            Then test access:<\/p>\n\n\n
            kubectl get<\/span> nodes\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
            \n\n\n\n
            \u2705 Step 5: Verify Access<\/strong><\/h2>\n\n\n\n
            If kubectl get nodes<\/code> still fails<\/strong>, check:<\/p>\n\n\n
            kubectl auth can-i list<\/span> nodes --all-namespaces --verbose\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
              \n
            • If “yes”<\/strong>, you have access.<\/li>\n\n\n\n
            • If “no”<\/strong>, IAM role or permissions need adjustment.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n
              \ud83c\udfaf Summary of AWS 2026 EKS Changes<\/strong><\/h3>\n\n\n\n
              \u2705 The aws-auth ConfigMap<\/strong> is no longer used.
              \u2705 IAM roles\/users are now added via EKS “Access” Tab<\/strong>.
              \u2705 Federated users need IAM role-based access via IAM access entries<\/strong>.<\/p>\n\n\n\n
              <\/p>\n","protected":false},"excerpt":{"rendered":"
              Thanks for pointing that out! The AWS EKS authentication method has changed in 2026, and the aws-auth ConfigMap is no longer used for adding IAM roles. Instead, IAM Access entries… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-48609","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=48609"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48609\/revisions"}],"predecessor-version":[{"id":58907,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48609\/revisions\/58907"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=48609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=48609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=48609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}