如何将 map IAM 组添加到 AWS 中的 EKS 集群？

Question

I deployed a EKS cluster and I'd like to add more IAM users to the role. I read this doc https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html and it mentioned how to map IAM users or roles to k8s but it doesn't say how to map IAM group. Is it not supported? or is there a way to do that? I don't want to map many users one by one. When a new user join the team, I just move them to the IAM group without changing anything in EKS.

Answer 1

You can't. You can only map roles and users. Directly from the documentation you linked:

3. Add your IAM users, roles, or AWS accounts to the configMap. You cannot add IAM groups to the configMap.

The easiest workaround would be to have a different IAM role for each group and only grant that group the ability to assume that role.

Answer 2

There is no simple and standardized implementation for this.

I've written a blog post that addresses your exact question - Enabling AWS IAM Group Access to an EKS Cluster Using RBAC

The blog covers the issue and the possible solutions. The solution we chose was to use an IAM role for each group and using a nice trick to assume it only for kubectl calls.