Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Configure EKS Dashboard integration with Amazon Organizations

This section provides step-by-step instructions for configuring the EKS Dashboard’s integration with Amazon Organizations. You’ll learn how to enable and disable trusted access between services, as well as how to register and deregister delegated administrator accounts. Each configuration task can be performed using either the Amazon console or the Amazon CLI.

Enable trusted access

Trusted access authorizes the EKS Dashboard to securely access cluster information across all accounts in your organization.

Using the Amazon console

Using the Amazon CLI

Disable trusted access

Disabling trusted access revokes the EKS Dashboard’s permission to access cluster information across your organization’s accounts.

Using the Amazon console

Using the Amazon CLI

Enable a delegated administrator account

A delegated administrator is a member account that’s granted permission to access the EKS Dashboard.

Using the Amazon console

Using the Amazon CLI

Disable a delegated administrator account

Disabling a delegated administrator removes the account’s permission to access the EKS Dashboard.

Using the Amazon console

Using the Amazon CLI

Minimum IAM policies required

This section outlines the minimum IAM policies required to enable trusted access and delegate an administrator for the EKS Dashboard integration with Amazon Organizations.

Policy for enabling trusted access

To enable trusted access between EKS Dashboard and Amazon Organizations, you need the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "organizations:EnableAWSServiceAccess",
                "organizations:DescribeOrganization",
                "organizations:ListAWSServiceAccessForOrganization"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::*:role/aws-service-role/dashboard.eks.amazonaws.com/AWSServiceRoleForAmazonEKSDashboard"
        }
    ]
}

Policy for delegating an administrator

To register or deregister a delegated administrator for the EKS Dashboard, you need the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "organizations:RegisterDelegatedAdministrator",
                "organizations:DeregisterDelegatedAdministrator",
                "organizations:ListDelegatedAdministrators"
            ],
            "Resource": "*"
        }
    ]
}

Policy to view EKS Dashboard

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonEKSDashboardReadOnly",
            "Effect": "Allow",
            "Action": [
                "eks:ListDashboardData",
                "eks:ListDashboardResources",
                "eks:DescribeClusterVersions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonOrganizationsReadOnly",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListRoots",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonOrganizationsDelegatedAdmin",
            "Effect": "Allow",
            "Action": [
                "organizations:ListDelegatedAdministrators"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringEquals": {
                    "organizations:ServicePrincipal": "eks.amazonaws.com"
                }
            }
        }
    ]
}