~/ nmadiraju.com Amazon EKS · RBAC
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How RBAC Works on Amazon EKS

Follow Priya's deploy of web from her IAM role through authentication and RBAC, then into a CI Pod, then check yourself with 8 questions.

1Visual Walkthrough

An EKS API request traced through authentication and RBAC authorization to namespaced and cluster-wide grants Left, Priya with IAM role shop-dev. An AWS account holds STS and an EKS access entry mapping the role to user shop-dev and group shop-devs. The API server authenticates, then authorizes with RBAC. Below it, cluster-wide ClusterRoles. Right, namespace shop with Deployment web, Role deployer and RoleBindings, and namespace ci with Pod deploy-runner and a RoleBinding to ClusterRole view. The walkthrough shows a 401, a 403 by default, Role and ClusterRole grants, a service account, and replacing cluster-admin with a narrow binding. Priya · kubectl IAM role shop-dev AWS ACCOUNT 111122223333 AWS STS · IAM role/shop-dev confirms who signed the token EKS access entry role/shop-dev → user shop-dev → group shop-devs KUBERNETES API SERVER 1 · Authentication who are you? IAM token or service account token 2 · Authorization (RBAC) may you do this? only if a binding grants it CLUSTER-WIDE · NO NAMESPACE ClusterRole node-viewer + binding → group shop-devs ClusterRole cluster-admin + binding → sa ci-deployer NAMESPACE shop Deployment web image web:1.5 what the deploy updates Role deployer deployments: patch + get, list, watch, create RoleBinding devs deployer → shop-devs RoleBinding ci deployer → ci-deployer NAMESPACE ci Pod deploy-runner sa ci-deployer its token is mounted in the Pod RoleBinding view ClusterRole view

    2Quiz to check understanding

    Check yourself