Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic Kubernetes Service

Amazon Elastic Kubernetes Service (service prefix: eks) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic Kubernetes Service
Actions defined by Amazon Elastic Kubernetes Service
Permission-only actions for Amazon Elastic Kubernetes Service
Resource types defined by Amazon Elastic Kubernetes Service
Condition keys for Amazon Elastic Kubernetes Service

API operations defined by Amazon Elastic Kubernetes Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateAccessPolicy	eks:AssociateAccessPolicy			Write
AssociateEncryptionConfig	eks:AssociateEncryptionConfig			Write
AssociateIdentityProviderConfig	eks:AssociateIdentityProviderConfig			Write
AssociateIdentityProviderConfig	eks:TagResource			Tagging, Write
CancelUpdate	eks:CancelUpdate			Write
CreateAccessEntry	eks:CreateAccessEntry			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
CreateAddon	eks:CreateAddon			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
CreateCapability	eks:CreateCapability			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
CreateCluster	eks:CreateAccessEntry			Write
	eks:CreateCluster			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com, eks.amazonaws.com	Write
CreateEksAnywhereSubscription	eks:CreateEksAnywhereSubscription			Write
CreateEksAnywhereSubscription	eks:TagResource			Tagging, Write
CreateFargateProfile	eks:CreateFargateProfile			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
CreateNodegroup	eks:CreateNodegroup			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
CreatePodIdentityAssociation	eks:CreatePodIdentityAssociation			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	pods.eks.amazonaws.com	Write
DeleteAccessEntry	eks:DeleteAccessEntry			Write
DeleteAddon	eks:DeleteAddon			Write
DeleteCapability	eks:DeleteCapability			Write
DeleteCluster	eks:DeleteCluster			Write
DeleteEksAnywhereSubscription	eks:DeleteEksAnywhereSubscription			Write
DeleteFargateProfile	eks:DeleteFargateProfile			Write
DeleteNodegroup	eks:DeleteNodegroup			Write
DeletePodIdentityAssociation	eks:DeletePodIdentityAssociation			Write
DeregisterCluster	eks:DeregisterCluster			Write
DescribeAccessEntry	eks:DescribeAccessEntry			Read
DescribeAddon	eks:DescribeAddon			Read
DescribeAddonConfiguration	eks:DescribeAddonConfiguration			Read
DescribeAddonVersions	eks:DescribeAddonVersions			Read
DescribeCapability	eks:DescribeCapability			Read
DescribeCluster	eks:DescribeCluster			Read
DescribeClusterVersions	eks:DescribeClusterVersions			Read
DescribeEksAnywhereSubscription	eks:DescribeEksAnywhereSubscription			Read
DescribeFargateProfile	eks:DescribeFargateProfile			Read
DescribeIdentityProviderConfig	eks:DescribeIdentityProviderConfig			Read
DescribeInsight	eks:DescribeInsight			Read
DescribeInsightsRefresh	eks:DescribeInsightsRefresh			Read
DescribeNodegroup	eks:DescribeNodegroup			Read
DescribePodIdentityAssociation	eks:DescribePodIdentityAssociation			Read
DescribeUpdate	eks:DescribeUpdate			Read
DisassociateAccessPolicy	eks:DisassociateAccessPolicy			Write
DisassociateIdentityProviderConfig	eks:DisassociateIdentityProviderConfig			Write
ListAccessEntries	eks:ListAccessEntries			List
ListAccessPolicies	eks:ListAccessPolicies			List
ListAddons	eks:ListAddons			List
ListAssociatedAccessPolicies	eks:ListAssociatedAccessPolicies			List
ListCapabilities	eks:ListCapabilities			List
ListClusters	eks:ListClusters			List
ListEksAnywhereSubscriptions	eks:ListEksAnywhereSubscriptions			List
ListFargateProfiles	eks:ListFargateProfiles			List
ListIdentityProviderConfigs	eks:ListIdentityProviderConfigs			List
ListInsights	eks:ListInsights			List
ListNodegroups	eks:ListNodegroups			List
ListPodIdentityAssociations	eks:ListPodIdentityAssociations			List
ListTagsForResource	eks:ListTagsForResource			Read
ListUpdates	eks:ListUpdates			List
RegisterCluster	eks:RegisterCluster			Write
	eks:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
StartInsightsRefresh	eks:StartInsightsRefresh			Write
TagResource	eks:TagResource			Tagging, Write
UntagResource	eks:UntagResource			Tagging, Write
UpdateAccessEntry	eks:UpdateAccessEntry			Write
UpdateAddon	eks:UpdateAddon			Write
UpdateAddon	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
UpdateCapability	eks:UpdateCapability			Write
UpdateCapability	iam:PassRole	iam:PassedToService	eks.amazonaws.com	Write
UpdateClusterConfig	eks:CreateAccessEntry			Write
	eks:UpdateClusterConfig			Write
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com, eks.amazonaws.com	Write
UpdateClusterVersion	eks:UpdateClusterVersion			Write
UpdateEksAnywhereSubscription	eks:UpdateEksAnywhereSubscription			Write
UpdateNodegroupConfig	eks:UpdateNodegroupConfig			Write
UpdateNodegroupVersion	eks:UpdateNodegroupVersion			Write
UpdatePodIdentityAssociation	eks:UpdatePodIdentityAssociation			Write
UpdatePodIdentityAssociation	iam:PassRole	iam:PassedToService	pods.eks.amazonaws.com	Write

Actions defined by Amazon Elastic Kubernetes Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateAccessPolicy	Grants permission to associate an Amazon EKS access policy to an Amazon EKS access entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:accessScope eks:clusterName eks:kubernetesGroups eks:namespaces eks:policyArn eks:principalArn eks:username	Write
AssociateEncryptionConfig	Grants permission to associate encryption configuration to a cluster	cluster*	aws:ResourceTag/${TagKey} eks:encryptionConfigProviderKeyArns	Write
AssociateIdentityProviderConfig	Grants permission to associate an identity provider configuration to a cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys eks:clientId eks:issuerUrl	Write
CancelUpdate	Grants permission to cancel an in-progress Kubernetes version update for an Amazon EKS cluster	cluster*	aws:ResourceTag/${TagKey}	Write
CreateAccessEntry	Grants permission to create an Amazon EKS access entry	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys eks:accessEntryType eks:kubernetesGroups eks:principalArn eks:username	Write
CreateAddon	Grants permission to create an Amazon EKS add-on	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAddon	Grants permission to create an Amazon EKS add-on	podidentityassociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCapability	Grants permission to create a capability for an Amazon EKS cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCluster	Grants permission to create an Amazon EKS cluster		aws:RequestTag/${TagKey} aws:TagKeys eks:authenticationMode eks:blockStorageEnabled eks:bootstrapClusterCreatorAdminPermissions eks:bootstrapSelfManagedAddons eks:computeConfigEnabled eks:controlPlaneEgressMode eks:controlPlaneScalingTier eks:deletionProtection eks:elasticLoadBalancingEnabled eks:encryptionConfigProviderKeyArns eks:endpointPrivateAccess eks:endpointPublicAccess eks:kubernetesVersion eks:loggingType/${type} eks:supportType eks:zonalShiftEnabled	Write
CreateEksAnywhereSubscription	Grants permission to create an EKS Anywhere subscription		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateFargateProfile	Grants permission to create an Amazon Fargate profile	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateNodegroup	Grants permission to create an Amazon EKS Nodegroup	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePodIdentityAssociation	Grants permission to create an EKS Pod Identity association	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAccessEntry	Grants permission to delete an Amazon EKS access entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	Write
DeleteAddon	Grants permission to delete an Amazon EKS add-on	addon*	aws:ResourceTag/${TagKey}	Write
DeleteAddon	Grants permission to delete an Amazon EKS add-on	podidentityassociation	aws:ResourceTag/${TagKey}	Write
DeleteCapability	Grants permission to delete a capability from an Amazon EKS cluster	capability*	aws:ResourceTag/${TagKey}	Write
DeleteCluster	Grants permission to delete an Amazon EKS cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteEksAnywhereSubscription	Grants permission to describe an EKS Anywhere subscription	eks-anywhere-subscription*	aws:ResourceTag/${TagKey}	Write
DeleteFargateProfile	Grants permission to delete an Amazon Fargate profile	fargateprofile*	aws:ResourceTag/${TagKey}	Write
DeleteNodegroup	Grants permission to delete an Amazon EKS Nodegroup	nodegroup*	aws:ResourceTag/${TagKey}	Write
DeletePodIdentityAssociation	Grants permission to delete an EKS Pod Identity association	podidentityassociation*	aws:ResourceTag/${TagKey}	Write
DeregisterCluster	Grants permission to deregister an External cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DescribeAccessEntry	Grants permission to describe an Amazon EKS access entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	Read
DescribeAddon	Grants permission to retrieve descriptive information about an Amazon EKS add-on	addon*	aws:ResourceTag/${TagKey}	Read
DescribeAddonConfiguration	Grants permission to list configuration options about an Amazon EKS add-on			Read
DescribeAddonVersions	Grants permission to retrieve descriptive version information about the add-ons that Amazon EKS Add-ons supports			Read
DescribeCapability	Grants permission to describe a capability for an Amazon EKS cluster	capability*	aws:ResourceTag/${TagKey}	Read
DescribeCluster	Grants permission to retrieve descriptive information about an Amazon EKS cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeClusterVersions	Grants permission to retrieve descriptive information about Kubernetes versions that Amazon EKS clusters support			Read
DescribeEksAnywhereSubscription	Grants permission to describe an EKS Anywhere subscription	eks-anywhere-subscription*	aws:ResourceTag/${TagKey}	Read
DescribeFargateProfile	Grants permission to retrieve descriptive information about an Amazon Fargate profile associated with a cluster	fargateprofile*	aws:ResourceTag/${TagKey}	Read
DescribeIdentityProviderConfig	Grants permission to retrieve descriptive information about an Idp config associated with a cluster	identityproviderconfig*	aws:ResourceTag/${TagKey}	Read
DescribeInsight	Grants permission to retrieve descriptive information of a detected insight for a specified cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeInsightsRefresh	Grants permission to retrieve the status of the latest on-demand cluster insights refresh operation	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeNodegroup	Grants permission to retrieve descriptive information about an Amazon EKS nodegroup	nodegroup*	aws:ResourceTag/${TagKey}	Read
DescribePodIdentityAssociation	Grants permission to describe an EKS Pod Identity association	podidentityassociation*	aws:ResourceTag/${TagKey}	Read
DescribeUpdate	Grants permission to retrieve a given update for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region)	addon	aws:ResourceTag/${TagKey}	Read
		capability	aws:ResourceTag/${TagKey}
		cluster*	aws:ResourceTag/${TagKey}
		nodegroup	aws:ResourceTag/${TagKey}
DisassociateAccessPolicy	Grants permission to disassociate an Amazon EKS access policy from an Amazon EKS acces entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:accessScope eks:clusterName eks:kubernetesGroups eks:namespaces eks:policyArn eks:principalArn eks:username	Write
DisassociateIdentityProviderConfig	Grants permission to delete an asssociated Idp config	identityproviderconfig*	aws:ResourceTag/${TagKey}	Write
ListAccessEntries	Grants permission to list all Amazon EKS access entries	cluster*	aws:ResourceTag/${TagKey}	List
ListAccessPolicies	Grants permission to list Amazon EKS access policies			List
ListAddons	Grants permission to list the Amazon EKS add-ons in your Amazon Web Services account (in the specified or default region) for a given cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListAssociatedAccessPolicies	Grants permission to list associated access policy on and Amazon EKS access entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	List
ListCapabilities	Grants permission to list capabilities for an Amazon EKS cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListClusters	Grants permission to list the Amazon EKS clusters in your Amazon Web Services account (in the specified or default region)			List
ListDashboardData	Grants permission to list dashboard data. The Amazon EKS Dashboard aggregates information about cluster resources across multiple accounts and regions. The dashboard includes information about EC2 Instances and EKS Cluster versions	dashboard*	aws:ResourceTag/${TagKey}	Read
ListDashboardResources	Grants permission to list dashboard resources. The Amazon EKS Dashboard aggregates information about cluster resources across multiple accounts and regions. The dashboard includes information about EC2 Instances and EKS Cluster versions	dashboard*	aws:ResourceTag/${TagKey}	Read
ListEksAnywhereSubscriptions	Grants permission to list EKS Anywhere subscriptions			List
ListFargateProfiles	Grants permission to list the Amazon Fargate profiles in your Amazon Web Services account (in the specified or default region) associated with a given cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListIdentityProviderConfigs	Grants permission to list the Idp configs in your Amazon Web Services account (in the specified or default region) associated with a given cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListInsights	Grants permission to list all detected insights for a specified cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListNodegroups	Grants permission to list the Amazon EKS nodegroups in your Amazon Web Services account (in the specified or default region) attached to given cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListPodIdentityAssociations	Grants permission to list EKS Pod Identity associations	cluster*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for the specified resource	addon	aws:ResourceTag/${TagKey}	Read
		capability	aws:ResourceTag/${TagKey}
		cluster	aws:ResourceTag/${TagKey}
		dashboard	aws:ResourceTag/${TagKey}
		eks-anywhere-subscription	aws:ResourceTag/${TagKey}
		fargateprofile	aws:ResourceTag/${TagKey}
		identityproviderconfig	aws:ResourceTag/${TagKey}
		nodegroup	aws:ResourceTag/${TagKey}
ListUpdates	Grants permission to list the updates for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region)	addon	aws:ResourceTag/${TagKey}	List
		capability	aws:ResourceTag/${TagKey}
		cluster*	aws:ResourceTag/${TagKey}
		nodegroup	aws:ResourceTag/${TagKey}
RegisterCluster	Grants permission to register an External cluster		aws:RequestTag/${TagKey} aws:TagKeys	Write
StartInsightsRefresh	Grants permission to initiate an on-demand refresh operation for cluster insights, getting the latest analysis outside of the standard refresh schedule	cluster*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag the specified resource	access-entry	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	Tagging, Write
		addon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		capability	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		eks-anywhere-subscription	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		fargateprofile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		identityproviderconfig	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		nodegroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		podidentityassociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag the specified resource	access-entry	aws:ResourceTag/${TagKey} aws:TagKeys eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	Tagging, Write
		addon	aws:ResourceTag/${TagKey} aws:TagKeys
		capability	aws:ResourceTag/${TagKey} aws:TagKeys
		cluster	aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:ResourceTag/${TagKey} aws:TagKeys
		eks-anywhere-subscription	aws:ResourceTag/${TagKey} aws:TagKeys
		fargateprofile	aws:ResourceTag/${TagKey} aws:TagKeys
		identityproviderconfig	aws:ResourceTag/${TagKey} aws:TagKeys
		nodegroup	aws:ResourceTag/${TagKey} aws:TagKeys
		podidentityassociation	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccessEntry	Grants permission to update an Amazon EKS access entry	access-entry*	aws:ResourceTag/${TagKey} eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username	Write
UpdateAddon	Grants permission to update Amazon EKS add-on configurations, such as the VPC-CNI version	addon*	aws:ResourceTag/${TagKey}	Write
UpdateAddon		podidentityassociation	aws:ResourceTag/${TagKey}	Write
UpdateCapability	Grants permission to update a capability for an Amazon EKS cluster	capability*	aws:ResourceTag/${TagKey}	Write
UpdateClusterConfig	Grants permission to update Amazon EKS cluster configurations (eg: API server endpoint access)	cluster*	aws:ResourceTag/${TagKey} eks:authenticationMode eks:blockStorageEnabled eks:computeConfigEnabled eks:controlPlaneEgressMode eks:controlPlaneScalingTier eks:deletionProtection eks:elasticLoadBalancingEnabled eks:endpointPrivateAccess eks:endpointPublicAccess eks:loggingType/${type} eks:supportType eks:zonalShiftEnabled	Write
UpdateClusterVersion	Grants permission to update the Kubernetes version of an Amazon EKS cluster	cluster*	aws:ResourceTag/${TagKey} eks:kubernetesVersion	Write
UpdateEksAnywhereSubscription	Grants permission to update an EKS Anywhere subscription	eks-anywhere-subscription*	aws:ResourceTag/${TagKey}	Write
UpdateNodegroupConfig	Grants permission to update Amazon EKS nodegroup configurations (eg: min/max/desired capacity or labels)	nodegroup*	aws:ResourceTag/${TagKey}	Write
UpdateNodegroupVersion	Grants permission to update the Kubernetes version of an Amazon EKS nodegroup	nodegroup*	aws:ResourceTag/${TagKey}	Write
UpdatePodIdentityAssociation	Grants permission to update an EKS Pod Identity association	podidentityassociation*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Elastic Kubernetes Service

The following actions are defined by Amazon Elastic Kubernetes Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AccessKubernetesApi	Grants permission to view Kubernetes objects via Amazon EKS console	cluster*	aws:ResourceTag/${TagKey}	Read
MutateViaKubernetesApi	Grants permission to modify Kubernetes objects via Amazon console	cluster*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Elastic Kubernetes Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
access-entry	arn:${Partition}:eks:${Region}:${Account}:access-entry/${ClusterName}/${IamIdentityType}/${IamIdentityAccountID}/${IamIdentityName}/${UUID}	aws:ResourceTag/${TagKey} eks:accessEntryType eks:clusterName eks:kubernetesGroups eks:principalArn eks:username
access-policy	arn:${Partition}:eks::aws:cluster-access-policy/${AccessPolicyName}
addon	arn:${Partition}:eks:${Region}:${Account}:addon/${ClusterName}/${AddonName}/${UUID}	aws:ResourceTag/${TagKey}
capability	arn:${Partition}:eks:${Region}:${Account}:capability/${ClusterName}/${CapabilityType}/${CapabilityName}/${UUID}	aws:ResourceTag/${TagKey}
cluster	arn:${Partition}:eks:${Region}:${Account}:cluster/${ClusterName}	aws:ResourceTag/${TagKey}
dashboard	arn:${Partition}:eks:${Region}:${Account}:dashboard/${DashboardName}	aws:ResourceTag/${TagKey}
eks-anywhere-subscription	arn:${Partition}:eks:${Region}:${Account}:eks-anywhere-subscription/${UUID}	aws:ResourceTag/${TagKey}
fargateprofile	arn:${Partition}:eks:${Region}:${Account}:fargateprofile/${ClusterName}/${FargateProfileName}/${UUID}	aws:ResourceTag/${TagKey}
identityproviderconfig	arn:${Partition}:eks:${Region}:${Account}:identityproviderconfig/${ClusterName}/${IdentityProviderType}/${IdentityProviderConfigName}/${UUID}	aws:ResourceTag/${TagKey}
nodegroup	arn:${Partition}:eks:${Region}:${Account}:nodegroup/${ClusterName}/${NodegroupName}/${UUID}	aws:ResourceTag/${TagKey}
podidentityassociation	arn:${Partition}:eks:${Region}:${Account}:podidentityassociation/${ClusterName}/${UUID}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Elastic Kubernetes Service

Amazon Elastic Kubernetes Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the EKS service	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the EKS service	ArrayOfString
eks:accessEntryType	Filters access by the access entry type present in the access entry requests the user makes to the EKS service	String
eks:accessScope	Filters access by the accessScope present in the associate / disassociate access policy requests the user makes to the EKS service	String
eks:authenticationMode	Filters access by the authenticationMode present in the create / update cluster request	String
eks:blockStorageEnabled	Filters access by the block storage enabled parameter in the create / update cluster request	Bool
eks:bootstrapClusterCreatorAdminPermissions	Filters access by the bootstrapClusterCreatorAdminPermissions present in the create cluster request	Bool
eks:bootstrapSelfManagedAddons	Filters access by the bootstrapSelfManagedAddons present in the create cluster request	Bool
eks:clientId	Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service	String
eks:clusterName	Filters access by the clusterName present in the access entry requests the user makes to the EKS service	String
eks:computeConfigEnabled	Filters access by the compute config enabled parameter in the create / update cluster request	Bool
eks:controlPlaneEgressMode	Filters access by the control plane egress mode specified in the create / update cluster request	String
eks:controlPlaneScalingTier	Filters access by the control plane scaling tier in the create / update cluster request	String
eks:deletionProtection	Filters access by the deletion protection setting in the create / update cluster request	Bool
eks:elasticLoadBalancingEnabled	Filters access by the elastic load balancing enabled parameter in the create / update cluster request	Bool
eks:encryptionConfigProviderKeyArns	Filters access by the KMS key ARNs in the create cluster / Associate Encryption Config request	ArrayOfARN
eks:endpointPrivateAccess	Filters access by the endpoint private access setting in the create / update cluster request	Bool
eks:endpointPublicAccess	Filters access by the endpoint public access setting in the create / update cluster request	Bool
eks:issuerUrl	Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service	String
eks:kubernetesGroups	Filters access by the kubernetesGroups present in the access entry requests the user makes to the EKS service	ArrayOfString
eks:kubernetesVersion	Filters access by the Kubernetes version in the create cluster/ update cluster version request	String
eks:loggingType/${type}	Filters access by the cluster logging enabled and type parameter in the create / update cluster request	Bool
eks:namespaces	Filters access by the namespaces present in the associate / disassociate access policy requests the user makes to the EKS service	ArrayOfString
eks:policyArn	Filters access by the policyArn present in the access entry requests the user makes to the EKS service	ARN
eks:principalArn	Filters access by the principalArn present in the access entry requests requests the user makes to the EKS service	ARN
eks:supportType	Filters access by the supportType present in the create / update cluster request	String
eks:username	Filters access by the Kubernetes username present in the access entry requests the user makes to the EKS service	String
eks:zonalShiftEnabled	Filters access by the zonal shift enabled setting in the create / update cluster request	Bool

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Elastic File System (elasticfilesystem)

Amazon Elastic MapReduce (elasticmapreduce)