AWSServiceRoleForAmazonEKSNodegroup
Description: Permissions required for managing nodegroups in the customer's account. These policies related to management of the following resources: AutoscalingGroups, SecurityGroups, LaunchTemplates and InstanceProfiles.
AWSServiceRoleForAmazonEKSNodegroup
is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy
details
-
Type: Service-linked role policy
-
Creation time: November 07, 2019, 01:34 UTC
-
Edited time: November 21, 2024, 00:07 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup
Policy version
Policy version: v10 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "SharedSecurityGroupRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DescribeInstances",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks" : "*"
}
}
},
{
"Sid" : "EKSCreatedSecurityGroupRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DescribeInstances",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "LaunchTemplateRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteLaunchTemplate",
"ec2:CreateLaunchTemplateVersion"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "AutoscalingRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"autoscaling:UpdateAutoScalingGroup",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:TerminateInstanceInAutoScalingGroup",
"autoscaling:CompleteLifecycleAction",
"autoscaling:PutLifecycleHook",
"autoscaling:PutNotificationConfiguration",
"autoscaling:EnableMetricsCollection",
"autoscaling:PutScheduledUpdateGroupAction",
"autoscaling:ResumeProcesses",
"autoscaling:SuspendProcesses"
],
"Resource" : "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*"
},
{
"Sid" : "AllowAutoscalingToCreateSLR",
"Effect" : "Allow",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "autoscaling.amazonaws.com"
}
},
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "*"
},
{
"Sid" : "AllowASGCreationByEKS",
"Effect" : "Allow",
"Action" : [
"autoscaling:CreateOrUpdateTags",
"autoscaling:CreateAutoScalingGroup"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name"
]
}
}
},
{
"Sid" : "AllowPassRoleToAutoscaling",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "autoscaling.amazonaws.com"
}
}
},
{
"Sid" : "AllowPassRoleToEC2",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "*",
"Condition" : {
"StringEqualsIfExists" : {
"iam:PassedToService" : [
"ec2.amazonaws.com"
]
}
}
},
{
"Sid" : "PermissionsToManageResourcesForNodegroups",
"Effect" : "Allow",
"Action" : [
"iam:GetRole",
"ec2:CreateLaunchTemplate",
"ec2:DescribeInstances",
"iam:GetInstanceProfile",
"ec2:DescribeLaunchTemplates",
"autoscaling:DescribeAutoScalingGroups",
"ec2:CreateSecurityGroup",
"ec2:DescribeLaunchTemplateVersions",
"ec2:RunInstances",
"ec2:DescribeSecurityGroups",
"ec2:GetConsoleOutput",
"ec2:DescribeRouteTables",
"ec2:DescribeSubnets",
"ec2:DescribeCapacityReservations"
],
"Resource" : "*"
},
{
"Sid" : "PermissionsToCreateAndManageInstanceProfiles",
"Effect" : "Allow",
"Action" : [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource" : "arn:aws:iam::*:instance-profile/eks-*"
},
{
"Sid" : "PermissionsToDeleteEKSAndKubernetesTags",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteTags"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid" : "PermissionsForManagedNodegroupsAutoRepair",
"Effect" : "Allow",
"Action" : [
"ec2:RebootInstances"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "PermissionsToCreateEKSAndKubernetesTags",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:*:ec2:*:*:security-group/*",
"arn:*:ec2:*:*:launch-template/*"
],
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid" : "AllowTaggingEC2ResourcesOnlyDuringInstanceCreation",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:*:ec2:*:*:instance/*",
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:network-interface/*"
],
"Condition" : {
"StringEquals" : {
"ec2:CreateAction" : [
"RunInstances"
]
},
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
}
]
}