Help improve this page
Want to contribute to this user guide? Choose the Edit this page on GitHub link that is located in the right pane of every page. Your contributions will help make our user guide better for everyone.
Understand Amazon EKS created RBAC roles and users
When you create a Kubernetes cluster, several default Kubernetes identities are created on that cluster for the proper functioning of Kubernetes. Amazon EKS creates Kubernetes identities for each of its default components. The identities provide Kubernetes role-based authorization control (RBAC) for the cluster components. For more information, see Using RBAC Authorization
When you install optional add-ons to your cluster, additional Kubernetes identities might be added to your cluster. For more information about identities not addressed by this topic, see the documentation for the add-on.
You can view the list of Amazon EKS created Kubernetes identities on your cluster using the AWS Management Console or kubectl
command line tool. All of the user identities appear in the kube
audit logs available to you through Amazon CloudWatch.
AWS Management Console
Prerequisite
The IAM principal that you use must have the permissions described in Required permissions.
To view Amazon EKS created identities using the AWS Management Console
-
Open the Amazon EKS console
. -
In the Clusters list, choose the cluster that contains the identities that you want to view.
-
Choose the Resources tab.
-
Under Resource types, choose Authorization.
-
Choose, ClusterRoles, ClusterRoleBindings, Roles, or RoleBindings. All resources prefaced with eks are created by Amazon EKS. Additional Amazon EKS created identity resources are:
-
The ClusterRole and ClusterRoleBinding named aws-node. The aws-node resources support the Amazon VPC CNI plugin for Kubernetes, which Amazon EKS installs on all clusters.
-
A ClusterRole named vpc-resource-controller-role and a ClusterRoleBinding named vpc-resource-controller-rolebinding. These resources support the Amazon VPC resource controller
, which Amazon EKS installs on all clusters.
In addition to the resources that you see in the console, the following special user identities exist on your cluster, though they’re not visible in the cluster’s configuration:
-
eks:cluster-bootstrap
– Used forkubectl
operations during cluster bootstrap. -
eks:support-engineer
– Used for cluster management operations.
-
-
Choose a specific resource to view details about it. By default, you’re shown information in Structured view. In the top-right corner of the details page you can choose Raw view to see all information for the resource.
Kubectl
Prerequisite
The entity that you use (AWS Identity and Access Management (IAM) or OpenID Connect (OIDC)) to list the Kubernetes resources on the cluster must be authenticated by IAM or your OIDC identity provider. The entity must be granted permissions to use the Kubernetes
get
and list
verbs for the Role
, ClusterRole
, RoleBinding
, and ClusterRoleBinding
resources on your cluster that you want the entity to work with. For more information about granting IAM entities access to your cluster, see Grant IAM users and roles access to Kubernetes APIs. For more information about granting entities authenticated by your own OIDC provider access to your cluster, see Grant users access to Kubernetes with an external OIDC provider.
To view Amazon EKS created identities using kubectl
Run the command for the type of resource that you want to see. All returned resources that are prefaced with eks are created by Amazon EKS. In addition to the resources returned in the output from the commands, the following special user identities exist on your cluster, though they’re not visible in the cluster’s configuration:
-
eks:cluster-bootstrap
– Used forkubectl
operations during cluster bootstrap. -
eks:support-engineer
– Used for cluster management operations.
ClusterRoles – ClusterRoles
are scoped to your cluster, so any permission granted to a role applies to resources in any Kubernetes namespace on the cluster.
The following command returns all of the Amazon EKS created Kubernetes
ClusterRoles
on your cluster.
kubectl get clusterroles | grep eks
In addition to the ClusterRoles
returned in the output that are prefaced with, the following ClusterRoles
exist.
-
aws-node
– ThisClusterRole
supports the Amazon VPC CNI plugin for Kubernetes, which Amazon EKS installs on all clusters. -
vpc-resource-controller-role
– ThisClusterRole
supports the Amazon VPC resource controller, which Amazon EKS installs on all clusters.
To see the specification for a ClusterRole
, replace eks:k8s-metrics
in the following command with a ClusterRole
returned in the output of the previous command. The following example returns the specification for the eks:k8s-metrics
ClusterRole
.
kubectl describe clusterrole eks:k8s-metrics
An example output is as follows.
Name: eks:k8s-metrics Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- [/metrics] [] [get] endpoints [] [] [list] nodes [] [] [list] pods [] [] [list] deployments.apps [] [] [list]
ClusterRoleBindings – ClusterRoleBindings
are scoped to your cluster.
The following command returns all of the Amazon EKS created Kubernetes
ClusterRoleBindings
on your cluster.
kubectl get clusterrolebindings | grep eks
In addition to the ClusterRoleBindings
returned in the output, the following ClusterRoleBindings
exist.
-
aws-node
– ThisClusterRoleBinding
supports the Amazon VPC CNI plugin for Kubernetes, which Amazon EKS installs on all clusters. -
vpc-resource-controller-rolebinding
– ThisClusterRoleBinding
supports the Amazon VPC resource controller, which Amazon EKS installs on all clusters.
To see the specification for a ClusterRoleBinding
, replace eks:k8s-metrics
in the following command with a ClusterRoleBinding
returned in the output of the previous command. The following example returns the specification for the eks:k8s-metrics
ClusterRoleBinding
.
kubectl describe clusterrolebinding eks:k8s-metrics
An example output is as follows.
Name: eks:k8s-metrics Labels: <none> Annotations: <none> Role: Kind: ClusterRole Name: eks:k8s-metrics Subjects: Kind Name Namespace ---- ---- --------- User eks:k8s-metrics
Roles – Roles
are scoped to a Kubernetes namespace. All Amazon EKS created Roles
are scoped to the kube-system
namespace.
The following command returns all of the Amazon EKS created Kubernetes
Roles
on your cluster.
kubectl get roles -n kube-system | grep eks
To see the specification for a Role
, replace eks:k8s-metrics
in the following command with the name of a Role
returned in the output of the previous command. The following example returns the specification for the eks:k8s-metrics
Role
.
kubectl describe role eks:k8s-metrics -n kube-system
An example output is as follows.
Name: eks:k8s-metrics Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- daemonsets.apps [] [aws-node] [get] deployments.apps [] [vpc-resource-controller] [get]
RoleBindings – RoleBindings
are scoped to a Kubernetes namespace. All Amazon EKS created RoleBindings
are scoped to the kube-system
namespace.
The following command returns all of the Amazon EKS created Kubernetes
RoleBindings
on your cluster.
kubectl get rolebindings -n kube-system | grep eks
To see the specification for a RoleBinding
, replace eks:k8s-metrics
in the following command with a RoleBinding
returned in the output of the previous command. The following example returns the specification for the eks:k8s-metrics
RoleBinding
.
kubectl describe rolebinding eks:k8s-metrics -n kube-system
An example output is as follows.
Name: eks:k8s-metrics Labels: <none> Annotations: <none> Role: Kind: Role Name: eks:k8s-metrics Subjects: Kind Name Namespace ---- ---- --------- User eks:k8s-metrics