eksctl创建EKS集群报iam:CreateRole无权限，需为AWS用户配置哪些权限？

报错根因分析 #

从报错信息可以定位两个核心权限问题：

1. 早期STS报错Error: checking AWS STS access – cannot get role ARN for current session 说明当前用户没有调用AWS STS服务验证身份的权限
2. 本次运行的核心报错是 IAM:CreateRole 操作被显式拒绝，同时eksctl通过CloudFormation批量创建VPC、EIP、EKS集群等资源时也需要对应服务的操作权限。

注意：显式拒绝的优先级高于所有允许策略，需要先排查当前用户附加的策略中是否有包含Effect: Deny且匹配iam:CreateRole操作的规则，先删除或修改该规则后再配置允许权限，否则新增的权限不会生效

需要配置的权限清单 #

测试环境快速配置 #

测试场景下可以直接给对应用户附加以下AWS托管策略，快速获取足够权限：

• AmazonEKSFullAccess：EKS服务全操作权限
• IAMFullAccess：IAM服务全操作权限
• AmazonEC2FullAccess：EC2服务全操作权限
• AWSCloudFormationFullAccess：CloudFormation服务全操作权限
• 自定义STS权限策略，允许sts:GetCallerIdentity操作

生产环境最小权限配置 #

生产场景建议按需裁剪权限，最小需要包含以下操作权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:GetCallerIdentity",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:PassRole",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:DeleteInstanceProfile"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStackEvents"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpc",
                "ec2:CreateSubnet",
                "ec2:CreateInternetGateway",
                "ec2:AllocateAddress",
                "ec2:CreateNatGateway",
                "ec2:CreateRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:CreateCluster",
                "eks:DescribeCluster",
                "eks:DeleteCluster",
                "eks:CreateNodegroup",
                "eks:DescribeNodegroup",
                "eks:DeleteNodegroup"
            ],
            "Resource": "*"
        }
    ]
}

内容的提问来源于stack exchange，提问作者Arefe