I am following the step guide to set up and kubernetes environment on AWS.


It already had some gochchas.. and they have been answered partially.

  1. https://stackoverflow.com/questions/51135795/error-the-server-doesnt-have-resource-type-svc
  2. https://stackoverflow.com/questions/50791303/kubectl-error-you-must-be-logged-in-to-the-server-unauthorized-when-accessing

For some reason, people were able to resolve using these guidelines available in these answers, and I still could not break it.

could not get token: AccessDenied: User: arn:aws:iam::sssssss:user/testprofileUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::sssssssss:role/eksServiceRole

What I have done:

  1. I created an IAM user with Admin privileges.(servicesDev).
  2. Created a IAM Role for EKS service (amazonEKSServiceRole)

amazonEKSServiceRole has a trust relationship as below,

  "Version": "2012-10-17",
  "Statement": [
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      "Action": "sts:AssumeRole"

This is my kubeconfig file,

apiVersion: v1
- cluster:
    server: https://7F30ANNSDSDMDCE1.ylq.us-east-1.eks.amazonaws.com
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURB...
  name: clouddev
- context:
    cluster: clouddev
    user: aws
  name: aws
current-context: aws
kind: Config
preferences: {}
- name: aws
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
        - "token"
        - "-i"
        - "clouddev"
        - "-r"
        - "arn:aws:iam::xxxxx:role/amazonEKSServiceRole"
        - name: AWS_PROFILE
          value: "testprofile"

To be clear I have a testprofile setup correctly in ~/.aws/credentials

If anybody can shed some light greatly appreciated.

  • Have you found a resolution to this issue? running into the same thing.
    – Mr.Budris
    Feb 21, 2019 at 22:26
  • @Mr.Budris The issue was trying to follow the documentation using root user. That is the issue. Rest should go smoothly if you do with with an different AIM
    – diyoda_
    Feb 21, 2019 at 22:56

3 Answers 3


You also need to setup the "trust relationship" for the AWSServiceRoleForAmazonEKS role which allows EKS to assume it.

Near the bottom of this link will be details on what to do:

Amazon EKS Service IAM Role

  • 2
    I was unable to resolve the issue with this documentation. I even created a new user and tried with that profile just to make sure that I am creating the EKS cluster using the same user I am trying to connect to it with.
    – diyoda_
    Aug 18, 2018 at 9:25

The only way I have been able to get this to work is to create the cluster using the CLI :

aws eks create-cluster --name <cluster name> 
   --role-arn <EKS Service Role> 
   --resources-vpc-config subnetIds=<subnet ids>,securityGroupIds=<security group id>

This is suggested in mutilple AWS resources and guides; this exact command to run it is from this SO answer : https://stackoverflow.com/a/53002925/8749874


My situation was, I had created the VPC using the root user and created the rest of the infra(eks control plane and worker nodes using a different user). When I recreated everything using same user (But not root user), things got smooth and was able to create a cluster using the aws documentation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .