Minimum EKS Permissions

Documented here is a minimum set of permissions necessary to use all functionality of the EKS driver in Rancher. Additional permissions are required for Rancher to provision the Service Role and VPC resources. Optionally these resources can be created before the cluster creation and will be selectable when defining the cluster configuration.

ResourceDescription
Service RoleThe service role provides Kubernetes the permissions it requires to manage resources on your behalf. Rancher can create the service role with the following Service Role Permissions.
VPCProvides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following VPC Permissions.

Resource targeting uses * as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher.

  1. {
  2.     "Version": "2012-10-17",
  3.     "Statement": [
  4.         {
  5.             "Sid": "EC2Permisssions",
  6.             "Effect": "Allow",
  7.             "Action": [
  8.                 "ec2:RunInstances",
  9.                 "ec2:RevokeSecurityGroupIngress",
  10.                 "ec2:RevokeSecurityGroupEgress",
  11.                 "ec2:DescribeVpcs",
  12.                 "ec2:DescribeTags",
  13.                 "ec2:DescribeSubnets",
  14.                 "ec2:DescribeSecurityGroups",
  15.                 "ec2:DescribeRouteTables",
  16.                 "ec2:DescribeLaunchTemplateVersions",
  17.                 "ec2:DescribeLaunchTemplates",
  18.                 "ec2:DescribeKeyPairs",
  19.                 "ec2:DescribeInternetGateways",
  20.                 "ec2:DescribeImages",
  21.                 "ec2:DescribeAvailabilityZones",
  22.                 "ec2:DescribeAccountAttributes",
  23.                 "ec2:DeleteTags",
  24.                 "ec2:DeleteSecurityGroup",
  25.                 "ec2:DeleteKeyPair",
  26.                 "ec2:CreateTags",
  27.                 "ec2:CreateSecurityGroup",
  28.                 "ec2:CreateLaunchTemplateVersion",
  29.                 "ec2:CreateLaunchTemplate",
  30.                 "ec2:CreateKeyPair",
  31.                 "ec2:AuthorizeSecurityGroupIngress",
  32.                 "ec2:AuthorizeSecurityGroupEgress"
  33.             ],
  34.             "Resource": "*"
  35.         },
  36.         {
  37.             "Sid": "CloudFormationPermisssions",
  38.             "Effect": "Allow",
  39.             "Action": [
  40.                 "cloudformation:ListStacks",
  41.                 "cloudformation:ListStackResources",
  42.                 "cloudformation:DescribeStacks",
  43.                 "cloudformation:DescribeStackResources",
  44.                 "cloudformation:DescribeStackResource",
  45.                 "cloudformation:DeleteStack",
  46.                 "cloudformation:CreateStackSet",
  47.                 "cloudformation:CreateStack"
  48.             ],
  49.             "Resource": "*"
  50.         },
  51.         {
  52.             "Sid": "IAMPermissions",
  53.             "Effect": "Allow",
  54.             "Action": [
  55.                 "iam:PassRole",
  56.                 "iam:ListRoles",
  57.                 "iam:ListRoleTags",
  58.                 "iam:ListInstanceProfilesForRole",
  59.                 "iam:ListInstanceProfiles",
  60.                 "iam:ListAttachedRolePolicies",
  61.                 "iam:GetRole",
  62.                 "iam:GetInstanceProfile",
  63.                 "iam:DetachRolePolicy",
  64.                 "iam:DeleteRole",
  65.                 "iam:CreateRole",
  66.                 "iam:AttachRolePolicy"
  67.             ],
  68.             "Resource": "*"
  69.         },
  70.         {
  71.             "Sid": "KMSPermisssions",
  72.             "Effect": "Allow",
  73.             "Action": "kms:ListKeys",
  74.             "Resource": "*"
  75.         },
  76.         {
  77.             "Sid": "EKSPermisssions",
  78.             "Effect": "Allow",
  79.             "Action": [
  80.                 "eks:UpdateNodegroupVersion",
  81.                 "eks:UpdateNodegroupConfig",
  82.                 "eks:UpdateClusterVersion",
  83.                 "eks:UpdateClusterConfig",
  84.                 "eks:UntagResource",
  85.                 "eks:TagResource",
  86.                 "eks:ListUpdates",
  87.                 "eks:ListTagsForResource",
  88.                 "eks:ListNodegroups",
  89.                 "eks:ListFargateProfiles",
  90.                 "eks:ListClusters",
  91.                 "eks:DescribeUpdate",
  92.                 "eks:DescribeNodegroup",
  93.                 "eks:DescribeFargateProfile",
  94.                 "eks:DescribeCluster",
  95.                 "eks:DeleteNodegroup",
  96.                 "eks:DeleteFargateProfile",
  97.                 "eks:DeleteCluster",
  98.                 "eks:CreateNodegroup",
  99.                 "eks:CreateFargateProfile",
  100.                 "eks:CreateCluster"
  101.             ],
  102.             "Resource": "*"
  103.         }
  104.     ]
  105. }

Service Role Permissions

Rancher will create a service role with the following trust policy:

  1. {
  2.   "Version": "2012-10-17",
  3.   "Statement": [
  4.     {
  5.       "Action": "sts:AssumeRole",
  6.       "Principal": {
  7.         "Service": "eks.amazonaws.com"
  8.       },
  9.       "Effect": "Allow",
  10.       "Sid": ""
  11.     }
  12.   ]
  13. }

This role will also have two role policy attachments with the following policies ARNs:

  1. arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
  2. arn:aws:iam::aws:policy/AmazonEKSServicePolicy

Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process.

  1. {
  2.   "Version": "2012-10-17",
  3.   "Statement": [
  4.     {
  5.       "Sid": "IAMPermisssions",
  6.       "Effect": "Allow",
  7.       "Action": [
  8.         "iam:AddRoleToInstanceProfile",
  9.         "iam:AttachRolePolicy",
  10.         "iam:CreateInstanceProfile",
  11.         "iam:CreateRole",
  12.         "iam:CreateServiceLinkedRole",
  13.         "iam:DeleteInstanceProfile",
  14.         "iam:DeleteRole",
  15.         "iam:DetachRolePolicy",
  16.         "iam:GetInstanceProfile",
  17.         "iam:GetRole",
  18.         "iam:ListAttachedRolePolicies",
  19.         "iam:ListInstanceProfiles",
  20.         "iam:ListInstanceProfilesForRole",
  21.         "iam:ListRoles",
  22.         "iam:ListRoleTags",
  23.         "iam:PassRole",
  24.         "iam:RemoveRoleFromInstanceProfile"
  25.       ],
  26.       "Resource": "*"
  27.     }
  28.   ]
  29. }

VPC Permissions

Permissions required for Rancher to create VPC and associated resources.

  1. {
  2.   "Sid": "VPCPermissions",
  3.   "Effect": "Allow",
  4.   "Action": [
  5.      "ec2:ReplaceRoute",
  6.      "ec2:ModifyVpcAttribute",
  7.      "ec2:ModifySubnetAttribute",
  8.      "ec2:DisassociateRouteTable",
  9.      "ec2:DetachInternetGateway",
  10.      "ec2:DescribeVpcs",
  11.      "ec2:DeleteVpc",
  12.      "ec2:DeleteTags",
  13.      "ec2:DeleteSubnet",
  14.      "ec2:DeleteRouteTable",
  15.      "ec2:DeleteRoute",
  16.      "ec2:DeleteInternetGateway",
  17.      "ec2:CreateVpc",
  18.      "ec2:CreateSubnet",
  19.      "ec2:CreateSecurityGroup",
  20.      "ec2:CreateRouteTable",
  21.      "ec2:CreateRoute",
  22.      "ec2:CreateInternetGateway",
  23.      "ec2:AttachInternetGateway",
  24.      "ec2:AssociateRouteTable"
  25.   ],
  26.   "Resource": "*"
  27. }