The Cluster IAM Role

Every EKS cluster needs an IAM role that lets the control plane manage AWS resources on your behalf.

When you create a cluster you must supply a cluster service role. The EKS control plane assumes this role to call other AWS APIs — for example, to manage the Elastic Network Interfaces and load balancers that Kubernetes needs.

The required policy

The role must trust the eks.amazonaws.com service and attach the AWS-managed AmazonEKSClusterPolicy.

Nodes need their own role

Don't confuse this with the node IAM role. Worker nodes assume a separate role (with policies like AmazonEKSWorkerNodePolicy and AmazonEC2ContainerRegistryReadOnly) so the kubelet can join the cluster and pull images.

eksctl creates both roles automatically — you mostly meet them when using the raw CLI or Terraform.

Example

Example · json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "eks.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}

When to use it

  • A security engineer creates a minimal EKS cluster IAM role with only the three AWS-managed policies required, avoiding over-permissioning.
  • A platform team uses Terraform to manage the cluster IAM role as code so it is consistently reproduced across dev, staging, and prod environments.
  • A compliance officer audits the trust policy on the EKS cluster role to confirm only the EKS service principal can assume it.

More examples

Create EKS cluster IAM role

Creates the IAM role with the correct trust policy for EKS and attaches the managed cluster policy required for control plane operation.

Example · bash
aws iam create-role \
  --role-name EKSClusterRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "eks.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'
aws iam attach-role-policy \
  --role-name EKSClusterRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy

Cluster IAM role in Terraform

Terraform resources to create and configure the EKS cluster IAM role, enabling infrastructure-as-code management of the permission boundary.

Example · hcl
resource "aws_iam_role" "eks_cluster" {
  name = "eks-cluster-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "eks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}
resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  role       = aws_iam_role.eks_cluster.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}

Verify role is attached to cluster

Confirms which IAM role ARN the EKS cluster is using, allowing auditors to verify the correct role is attached.

Example · bash
aws eks describe-cluster \
  --name my-cluster \
  --query 'cluster.roleArn' \
  --output text

Discussion

  • Be the first to comment on this lesson.