Question

我已经按照文档整理了一个EKS集群，该集群说要使用某些策略来充当服务角色。

https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf

To create your Amazon EKS service role
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. Choose Roles, then Create role.
3. Choose EKS from the list of services, then Allows Amazon EKS to manage your clusters on your behalf for your use case, then Next: Permissions.
4. Choose Next: Review.
5. For Role name, enter a unique name for your role, such as eksServiceRole, then choose Create role.

当我创建一个基本的hello world应用程序时，它会引发AccessDenied错误。

Error creating load balancer (will retry): failed to ensure load balancer for service default/nginx:
AccessDenied: User: arn:aws:sts::*************:assumed-role/eks-service-role/************* is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::*************:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing

添加的两个策略（AmazonEKSClusterPolicy，AmazonEKSServicePolicy）不允许使用iam：CreateServiceLinkedRole操作。我们是否应该将其添加到指南中定义的策略之外？还是应该将其包含在EKS政策中？

Answer 1

似乎EKS用户指南假定您在创建EKS集群之前已在AWS账户中创建了负载均衡器，因此在AWS IAM中具有现有的 AWSServiceRoleForElasticLoadBalancing 服务角色。

如says

中所述

You don't need to manually create the AWSServiceRoleForElasticLoadBalancing role. Elastic Load Balancing creates this role for you when you create a load balancer.

EKS尝试为您执行此操作，导致使用默认策略的拒绝访问异常。

在创建EKS集群之前显式创建与服务相关的角色的其他选项包括：

AWS CLI

aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"

地形

resource "aws_iam_service_linked_role" "elasticloadbalancing" {
  aws_service_name = "elasticloadbalancing.amazonaws.com"
}

或者，从UI控制台手动创建负载均衡器。

无论使用哪种配置选项，当您在AWS IAM中看到以下角色时，您都应该知道一切都会起作用

arn:aws:iam::<ACCOUNT_ID>:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing

Answer 2

我通过将此策略添加到EKS角色中来使其有效：

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "iam:CreateServiceLinkedRole",
                "Resource": "arn:aws:iam::*:role/aws-service-role/*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "ec2:DescribeAccountAttributes"
                ],
                "Resource": "*"
            }
        ]
    }

AWS EKS“无权执行：iam：CreateServiceLinkedRole”

2 个答案: