Is not authorized to perform: iam:PassRole on resource: arn:aws:iam::227680169240:role/EKS_Role

Cloud AWS
#1

Screenshot 2024-01-10 at 6.03.23 PM
Screenshot 2024-01-10 at 6.03.23 PM1802×266 15.3 KB

User: arn:aws:iam::227680169240:user/kk_labs_user_329731 is not authorized to perform: iam:PassRole on resource: arn:aws:iam::227680169240:role/EKS_Role

While creating an EKS cluster in AWS, I encountered an error. , and also attached screenshot of the error. and I can’t log AWS CLI using IAM Access and secret key, Could you please help me resolve it.

#2

You cannot create managed node groups, and you need to use specific roles on the playground.

Please follow one of these two guides to deploy EKS

#3

hi @ Alistair Mackay, Thanks for you reply now I can able to create EKS Cluster in AWS Playground, but I can’t able to create NodeGroups in EKS, I got error like below, could you please help me to resolve it ?

image
image1636×168 16.2 KB

User: arn:aws:iam::511964875546:user/kk_labs_user_363693 is not authorized to perform: eks:CreateNodegroup on resource: arn:aws:eks:us-east-1:511964875546:cluster/demo-eks with an explicit deny

1 Like
#4

You are trying to create a managed node group. As mentioned above, you cannot do this.
Please follow the playground series guide above to learn how to create an unmanaged node group.

#5

Hi @Alistair_KodeKloud,

I am doing the KodeKloud Engeers aws Level 3 Task 10

followed the steps as shown in the above link but I am unable to create EKS cluster facing similar error

image
image964×106 15 KB
.

Here is the config screenshot of the EKS

image
image1332×459 29.8 KB

image
image1597×730 48.2 KB

seems to be bug with the Task.

#6

I was able to create the cluster with this role, I was able to cluster

{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {
“Service”: “eks.amazonaws.com”
},
“Action”: “sts:AssumeRole”
}
]
}

#7

AutoNodeRole is for managed nodes which are not permitted by our AWS accounts. I cannot imagine the task will direct you to create the same.
Configure the cluster as per our playground instructions and it should launch.

#8

@Alistair_KodeKloud I am following the guide on GitHub for playgrounds.
I was able to create the cluster a few times…but I run into the below error a lot. I am not using node groups for roles

User: arn:aws:iam::654654139377:user/kk_labs_user_545305 is not authorized to perform: iam:PassRole on resource: arn:aws:iam::654654139377:role/ekscluster

#9

Hi @Obaid ,

The role name is “eksclusterRole”, not “eksCluster”.

#10

It’s already written in the doc that you’re following.

certified-kubernetes-administrator-course/managed-clusters/eks/console/docs/02-create-service-role.md at master · kodekloudhub/certified-kubernetes-administrator-course · GitHub

#11

oh. I thought the name could be anything. I deployed it. thanks

I also deployed it using the terraform code above but it does not automate the node deployment? is it all manual for that?

#12

A couple of things here

  • Permissions such as iam:PassRole are granted to only specific role names in playground accounts, so no, the role cannot have any name
  • The terraform provisions the EC2 instances for the nodes. It does not join them to the cluster. That is done using the node instance role which is printed at the end of the terraform run, here.