The Cluster IAM Role
Every EKS cluster needs an IAM role that lets the control plane manage AWS resources on your behalf.
When you create a cluster you must supply a cluster service role. The EKS control plane assumes this role to call other AWS APIs — for example, to manage the Elastic Network Interfaces and load balancers that Kubernetes needs.
The required policy
The role must trust the eks.amazonaws.com service and attach the AWS-managed AmazonEKSClusterPolicy.
Nodes need their own role
Don't confuse this with the node IAM role. Worker nodes assume a separate role (with policies like AmazonEKSWorkerNodePolicy and AmazonEC2ContainerRegistryReadOnly) so the kubelet can join the cluster and pull images.
eksctl creates both roles automatically — you mostly meet them when using the raw CLI or Terraform.
Example
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "Service": "eks.amazonaws.com" },
"Action": "sts:AssumeRole"
}
]
}When to use it
- A security engineer creates a minimal EKS cluster IAM role with only the three AWS-managed policies required, avoiding over-permissioning.
- A platform team uses Terraform to manage the cluster IAM role as code so it is consistently reproduced across dev, staging, and prod environments.
- A compliance officer audits the trust policy on the EKS cluster role to confirm only the EKS service principal can assume it.
More examples
Create EKS cluster IAM role
Creates the IAM role with the correct trust policy for EKS and attaches the managed cluster policy required for control plane operation.
aws iam create-role \
--role-name EKSClusterRole \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Service": "eks.amazonaws.com"},
"Action": "sts:AssumeRole"
}]
}'
aws iam attach-role-policy \
--role-name EKSClusterRole \
--policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicyCluster IAM role in Terraform
Terraform resources to create and configure the EKS cluster IAM role, enabling infrastructure-as-code management of the permission boundary.
resource "aws_iam_role" "eks_cluster" {
name = "eks-cluster-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = { Service = "eks.amazonaws.com" }
Action = "sts:AssumeRole"
}]
})
}
resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
role = aws_iam_role.eks_cluster.name
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}Verify role is attached to cluster
Confirms which IAM role ARN the EKS cluster is using, allowing auditors to verify the correct role is attached.
aws eks describe-cluster \
--name my-cluster \
--query 'cluster.roleArn' \
--output text
Discussion