EKS IAM Role

Cluster

cluster-trust-policy.json

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": "eks.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
    }]
}

aws iam create-role \
  --role-name eksClusterRole \
  --assume-role-policy-document file://cluster-trust-policy.json

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy \
  --role-name eksClusterRole

Node

node-role-trust-relationship.json

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": "ec2.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
    }]
} 

aws iam create-role \
  --role-name AmazonEKSNodeRole \
  --assume-role-policy-document file://node-role-trust-relationship.json

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy \
  --role-name AmazonEKSNodeRole
aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
  --role-name AmazonEKSNodeRole
aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy \
  --role-name AmazonEKSNodeRole

Fargate

pod-execution-role-trust-policy.json

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Condition": {
            "ArnLike": {
                "aws:SourceArn": "arn:aws:eks:$AWS_DEFAULT_REGION:$AWS_ACCOUNT_ID:fargateprofile/$CLUSTER_NAME/*"
            }
        },
        "Principal": {
            "Service": "eks-fargate-pods.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
    }]
}

aws iam create-role \
  --role-name AmazonEKSFargatePodExecutionRole \
  --assume-role-policy-document file://pod-execution-role-trust-policy.json

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy \
  --role-name AmazonEKSFargatePodExecutionRole