amazon-web-services - EKS 无法使用 Kubectl 对 Kubernetes 进行身份验证 - "User: is not authorized to perform: sts:AssumeRole"

Question

我最初运行 aws --region eu-west-1 eks update-kubeconfig --name prod-1234 --role-arn arn:aws:iam::1234:user/chris-devops访问 EKS 集群。

执行以下操作时:kubectl get ...我收到以下错误:

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::1234:user/chris-devops is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::1234:user/chris-devops

为什么我会收到这个错误？我如何获得访问权限？

我已经向用户添加了以下内容:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::1234:user/chris-devops"
        }
    ]
}

此外，我还拥有完整的管理员访问权限:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

我已通读: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_cant-assume-role

我的理解是我符合所有标准。

Answer 1

你的政策是错误的。用户不能假设另一个 IAM 用户。它应该是这样的:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "sts:AssumeRole"
        ],
        "Resource": "arn:aws:iam::1234:role/prod-Eks-1234-admins"
    }
]
}