Kubectl访问EKS遇AccessDenied：根账户无法AssumeRole问题排查

错误信息 #

执行kubectl auth can-i get svc时返回以下错误：

An error occurred (AccessDenied) when calling the AssumeRole operation: Roles may not be assumed by root accounts.
E0807 01:37:54.011751    2699 memcache.go:265] couldn't get current server API group list: Get "https://55F0139D24BC8EE6FF9E008F6A817620.gr7.eu-north-1.eks.amazonaws.com/api?timeout=32s": getting credentials: exec: executable aws failed with exit code 254

当前kubeconfig配置 #

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://123E008F6A817620.gr7.eu-north-1.eks.amazonaws.com
  name: arn:aws:eks:eu-north-1:00009:cluster/DeveleapEKS
contexts:
- context:
    cluster: arn:aws:eks:eu-north-1:0000:cluster/DeveleapEKS
    user: arn:aws:eks:eu-north-1:000000:cluster/DeveleapEKS
  name: arn:aws:eks:eu-north-1:00:cluster/DeveleapEKS
current-context: arn:aws:eks:eu-north-1:00000:cluster/DeveleapEKS
kind: Config
preferences: {}
users:
- name: arn:aws:eks:eu-north-1:00000:cluster/DeveleapEKS
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - --region
      - eu-north-1
      - eks
      - get-token
      - --cluster-name
      - DeveleapEKS
      - --output
      - json
      - --role
      - arn:aws:iam::00000000:role/DeveleapEksRole
      command: aws
      env: null
      interactiveMode: IfAvailable
      provideClusterInfo: false

注：为安全起见已将ARN替换为随机的'0'，实际kubeconfig中使用的是正确的IAM用户ARN。

已尝试的操作 #

• 创建拥有EKS全权限的新IAM用户
• 添加用于EKS访问的新角色
• 修改内联策略为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "eks:AccessKubernetesApi",
                "eks:*"
            ],
            "Resource": "*"
        }
    ]
}

• 修改信任关系为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::000000000:user/DeveleapUser"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

解决方案 #

错误核心原因是当前AWS CLI使用的是根账号凭证，而AWS不允许根账号扮演IAM角色。按以下步骤修复：

1. 检查当前AWS凭证
   执行命令：

   aws configure list
   

   查看输出中的access_key字段，确认是否为根账号的Access Key。

2. 切换到IAM用户凭证
   执行aws configure，输入你创建的IAM用户DeveleapUser的Access Key ID、Secret Access Key，区域填eu-north-1，输出格式选json。

3. 验证凭证切换
   再次运行aws configure list，确认显示的是IAM用户的凭证信息。

4. 重新测试kubectl命令
   执行kubectl auth can-i get svc，验证权限查询是否正常。

额外注意：

• 核对IAM用户DeveleapUser的权限策略和目标角色DeveleapEksRole的信任关系，确保ARN完全匹配，无拼写错误。
• 若使用多AWS配置文件，需通过export AWS_PROFILE=你的配置文件名切换到对应IAM用户的配置文件。

内容的提问来源于stack exchange，提问作者zolo