Associating and disassociating access policies to and from access entries

Open the Amazon EKS console at https://console.amazonaws.cn/eks/home#/clusters.

Choose the name of the cluster that has an access entry that you want to associate an access policy to.

Choose the Access tab.

If the type of the access entry is Standard, you can associate or disassociate Amazon EKS access policies. If the type of your access entry is anything other than Standard, then this option isn't available.

Choose Associate access policy.

For Policy name, select the policy with the permissions you want the IAM principal to have. To view the permissions included in each policy, see Access policy permissions.

For Access scope, choose an access scope. If you choose Cluster, the permissions in the access policy are granted to the IAM principal for resources in all Kubernetes namespaces. If you choose Kubernetes namespace, you can then choose Add new namespace. In the Namespace field that appears, you can enter the name of a Kubernetes namespace on your cluster. If you want the IAM principal to have the permissions across multiple namespaces, then you can enter multiple namespaces.

Choose Add access policy.

View the available access policies.

aws eks list-access-policies --output table

An example output is as follows.

---------------------------------------------------------------------------------------------------------
|                                          ListAccessPolicies                                           |
+-------------------------------------------------------------------------------------------------------+
||                                           accessPolicies                                            ||
|+---------------------------------------------------------------------+-------------------------------+|
||                                 arn                                 |             name              ||
|+---------------------------------------------------------------------+-------------------------------+|
||  arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy        |  AmazonEKSAdminPolicy         ||
||  arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy |  AmazonEKSClusterAdminPolicy  ||
||  arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSEditPolicy         |  AmazonEKSEditPolicy          ||
||  arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSViewPolicy         |  AmazonEKSViewPolicy          ||
|+---------------------------------------------------------------------+-------------------------------+|

To view the permissions included in each policy, see Access policy permissions.

View your existing access entries. Replace my-cluster with the name of your cluster.

aws eks list-access-entries --cluster-name my-cluster

An example output is as follows.

{
    "accessEntries": [
        "arn:aws-cn:iam::111122223333:role/my-role",
        "arn:aws-cn:iam::111122223333:user/my-user"
    ]
}

Associate an access policy to an access entry. The following example associates the AmazonEKSViewPolicy access policy to an access entry. Whenever the my-role IAM role attempts to access Kubernetes objects on the cluster, Amazon EKS will authorize the role to use the permissions in the policy to access Kubernetes objects in the my-namespace1 and my-namespace2 Kubernetes namespaces only. Replace my-cluster with the name of your cluster, 111122223333 with your Amazon Web Services account ID, and my-role with the name of the IAM role that you want Amazon EKS to authorize access to Kubernetes cluster objects for.

aws eks associate-access-policy --cluster-name my-cluster --principal-arn arn:aws-cn:iam::111122223333:role/my-role \
    --access-scope type=namespace,namespaces=my-namespace1,my-namespace2 --policy-arn arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSViewPolicy

If you want the IAM principal to have the permissions cluster-wide, replace type=namespace,namespaces=my-namespace1,my-namespace2 with type=cluster. If you want to associate multiple access policies to the access entry, run the command multiple times, each with a unique access policy. Each associated access policy has its own scope.

Determine which access policies are associated to an access entry.

aws eks list-associated-access-policies --cluster-name my-cluster --principal-arn arn:aws-cn:iam::111122223333:role/my-role

An example output is as follows.

{
    "clusterName": "my-cluster",
    "principalArn": "arn:aws-cn:iam::111122223333",
    "associatedAccessPolicies": [
        {
            "policyArn": "arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSViewPolicy",
            "accessScope": {
                "type": "cluster",
                "namespaces": []
            },
            "associatedAt": "2023-04-17T15:25:21.675000-04:00",
            "modifiedAt": "2023-04-17T15:25:21.675000-04:00"
        },
        {
            "policyArn": "arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy",
            "accessScope": {
                "type": "namespace",
                "namespaces": [
                    "my-namespace1",
                    "my-namespace2"
                ]
            },
            "associatedAt": "2023-04-17T15:02:06.511000-04:00",
            "modifiedAt": "2023-04-17T15:02:06.511000-04:00"
        }
    ]
}

In the previous example, the IAM principal for this access entry has view permissions across all namespaces on the cluster, and administrator permissions to two Kubernetes namespaces.

Disassociate an access policy from an access entry. In this example, the AmazonEKSAdminPolicy policy is disassociated from an access entry. The IAM principal retains the permissions in the AmazonEKSViewPolicy access policy for objects in the my-namespace1 and my-namespace2 namespaces however, because that access policy is not disassociated from the access entry.

aws eks disassociate-access-policy --cluster-name my-cluster --principal-arn arn:aws-cn:iam::111122223333:role/my-role \
    --policy-arn arn:aws-cn:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy