Add IAM User & IAM Role to AWS EKS: AWS EKS Kubernetes Tutorial - Part 3 

❤️

❤️

thank you!😊

thanks, yeah we use okta roles

❤️

Thanks! 😃

thanks will do

thank you! :)

❤️

i have one pretty old but uses the same principal RU-vid - ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-EGdN21F2Jfw.html Blog - antonputra.com/kubernetes/add-iam-user-and-iam-role-to-eks/

❤️

thank you for support!

my pleasure!

welcome! Kubernetes does not have RBAC groups objects you can only find them by describing bindings. my-viewer - github.com/antonputra/tutorials/blob/main/lessons/196/1-example/1-viewer-cluster-role-binding.yaml#L12C11-L12C20 my-admin - github.com/antonputra/tutorials/blob/main/lessons/196/2-example/admin-cluster-role-binding.yaml#L12

adobe suite

you can but if you map it to service account, most likelly you would want to use eks pod identeties or open id connect provider. What's your use case?

Sure, first you create RBAC role/cluster role, then you map that role with RBAC group for example viewer, then you create IAM user and map that user with viewer RBAC role using EKS API. I cover it in the video

@@AntonPutra thanks for quick reply, can you suggest the differences generally we create a role and role binding then generate a kubeconfig for that user and deployed the kubeconfig at user machine or profile but here we are using I am to authenticate so that time we are binding the same role of K8s with user to assume i,e here user will not require the kubeconfi file and user will manage via IAM user profile i.e if user will remove from AWS IAM then he or she will not be able to access and here you are using same machine to generate multiple profiles which should not be a good practice and we have to use either to create multiple users in single machine on aws jump server to connect? will appreciate to clear my doubts

@@Kk-rl7nv In the real world, most of the time, we would use federated users managed by Okta or Azure Active Directory. So, you, the user, will be able to assume roles from the get-go. You just add that role to the EKS. I didn't get the rest of the question.

you cannot use IAM groups, only IAM roles and users

@@AntonPutra ok, Then every user we need to grant separately. Is there a way to assign it to group. I just want simplify access management with aws groups instead of individual users.

@@chandrashekharn6539 you can create IAM Group that would allow assuming IAM role to access EKS cluster, so in that way you only need to place your IAM user to that group only

@@AntonPutra I am trying with your suggestion, I am bit confused what to provide to principal. Could you please provide sample code for it.

@@chandrashekharn6539 1. Create IAM role “my-role” - github.com/antonputra/tutorials/blob/main/lessons/196/terraform/10-add-manager-role.tf#L3-L54 2. Create IAM group “my-group” 3. Create IAM policy “my-assume-policy” which would allow IAM user to assume “”my-role - github.com/antonputra/tutorials/blob/main/lessons/196/terraform/10-add-manager-role.tf#L60-L77 4. Create IAM user and place it in “my-group” IAM group 5. Bind EKS with IAM role “my-role” - github.com/antonputra/tutorials/blob/main/lessons/196/terraform/10-add-manager-role.tf#L85-L89

Do you mean how to mount secrets from harshicorp vault to pods as files and env?

@@AntonPutra yes secrets as well as using aws auth how we can assume the role and get token from vault

@@Saalar3259 ok, added to my list

you have tried this? delete credentials and reconfigure? also try to clean aws cache stackoverflow.com/questions/34582318/how-can-i-resolve-the-error-the-security-token-included-in-the-request-is-inval

@@AntonPutra I sloved the issue, thanks.

@@mzw8374 what was the issue? just that i know if someone else facing the same problem

@@AntonPutra As same as what you shared from the stackoverflow, I reset everything and re-applied terraform

@@mzw8374 ok thanks

ok will do