aws setup aws account iam for eks

Table of Contents

• Setup AWS account IAM for deployment in EKS
  • Preparing environment
  • Prerequisites
    • Alternative
  • Creating IAM user using provided script
    • Usage
    • Flags
    • Example
    • After execution
  • Check IAM user permissions
    • Usage
    • Flags
    • Example
  • Configure AWS CLI

Setup AWS account IAM for deployment in EKS

The scope of this section is to prepare an AWS account to be ready for deploying in AWS EKS. By the end of this guide, a new IAM user belonging to a group with the required permissions will be created.

Preparing environment

First of all, install AWS CLI and Python for your OS.

Prerequisites

• An AWS account with IAM full access permission.

Alternative

In case you do not have an account or permission to create new IAM users, request it to your AWS administrator asking for the following policies being attached. Then go to Check IAM user permissions.

Required managed policies

AmazonEC2FullAccess
IAMReadOnlyAccess
AmazonEKSServicePolicy
AmazonS3FullAccess
AmazonEC2ContainerRegistryFullAccess

Required custom policies

Find them on /scripts/accounts/aws/eks-custom-policies.json.

Creating IAM user using provided script

The script located at /scripts/accounts/aws/create-user.sh will automatically create a user, also enrolling it in a newly created group with the required policies attached.

In case you do not have an AWS access key (needed to authenticate through API), follow this guide to create it.

Usage

create-user.sh \
  -u <username> \
  -g <group> \
  [-p <policies...>] \
  [-f <policies file path>] \
  [-c <custom policies file path>] \
  [-a <AWS access key>] \
  [-s <AWS secret key>] \
  [-r <region>] 

Flags

-u      [Required] Username for the new user
-g      [Required] Group name for the group to be created or used
-p      [Optional] Policies to be attached to the group, splitted by comma
-f      [Optional] Path to a file containing the policies to be attached to the group
-c      [Optional] Path to a json file containing the custom policies to be attached to the group.
-a      [Optional] AWS administrator access key
-s      [Optional] AWS administrator secret key
-r      [Optional] AWS region

Example

./create-user.sh -u Bob -g DevOps -f ./eks-managed-policies.txt -c ./eks-custom-policies.json -a "myAccessKey" -s "mySecretKey" -r eu-west-1

NOTE: If the "DevOps" group does not exist, it will be created.

Note	Required policies for using EKS are located at /scripts/accounts/aws/eks-managed-policies.txt and /scripts/accounts/aws/eks-custom-policies.json

After execution

On success, the newly created user access data will be shown as output:

Access key ID: <accessKeyID>
Secret access key: <secretAccessKey>

Important

It is mandatory to store the access key ID and the secret access key securely at this point, as they will not be retrievable again.

Check IAM user permissions

The script located at /scripts/accounts/aws/verify-account-policies.sh will check that the necessary policies were attached to the IAM user.

Usage

verify-account-policies.sh \
  -u <username> \
  [-p <policies...>] \
  [-f <policies file path>] \
  [-c <custom policies file path>] \
  [-a <AWS access key>] \
  [-s <AWS secret key>] \
  [-r <region>] 

Flags

-u      [Required] Username whose policies will be checked
-p      [Optional] Policies to be checked, splitted by comma
-f      [Optional] Path to a file containing the policies to be checked
-c      [Optional] Path to a file containing the custom policies to be checked
-a      [Optional] AWS administrator access key
-s      [Optional] AWS administrator secret key
-r      [Optional] AWS region

NOTE: At least one policies flag (-p, -f or -c) is required.

Example

./verify-account-policies.sh -u Bob -f ./eks-managed-policies.txt -c ./eks-custom-policies.json -a "myAccessKey" -s "mySecretKey" -r eu-west-1

After execution, provided policies will be shown preceded by an OK or FAILED depending on the attachment status.

Note	Required policies for using EKS are located at /scripts/accounts/aws/eks-managed-policies.txt and /scripts/accounts/aws/eks-custom-policies.json

Configure AWS CLI

Once you have been provided with an IAM user with the required policies attached, setup the AWS CLI using the following command:

aws configure

Fill the prompted fields with your data:

AWS Access Key ID [None]: <accessKeyID>
AWS Secret Access Key [None]: <secretAccessKey>
Default region name [None]: eu-west-1
Default output format [None]: json

Now you have AWS CLI ready to use.