AWS EKS "is not authorized to perform: iam:CreateServiceLinkedRole"

Question

我已经遵循了关于建立EKS集群的文档，该集群表示使用某些策略来扮演服务角色。

https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf

To create your Amazon EKS service role
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. Choose Roles, then Create role.
3. Choose EKS from the list of services, then Allows Amazon EKS to manage your clusters on your behalf for your use case, then Next: Permissions.
4. Choose Next: Review.
5. For Role name, enter a unique name for your role, such as eksServiceRole, then choose Create role.

当我创建一个基本的helloworld应用程序时，它会抛出一个AccessDenied错误。

Error creating load balancer (will retry): failed to ensure load balancer for service default/nginx:
AccessDenied: User: arn:aws:sts::*************:assumed-role/eks-service-role/************* is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::*************:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing

添加的两个策略(AmazonEKSClusterPolicy、AmazonEKSServicePolicy(不允许执行iam:CreateServiceLinkedRole操作。我们是否应该将其添加到指南中定义的政策之外？或者这是EKS政策中应该包含的内容吗？

Answer 1

EKS用户指南似乎假设您在创建EKS集群之前已经在AWS帐户中创建了负载平衡器，因此在AWS IAM中有一个现有的AWSServiceRoleForElasticLoadBalancing服务角色。

如中所述https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/elb-service-linked-roles.html#create-服务链接角色

You don't need to manually create the AWSServiceRoleForElasticLoadBalancing role. Elastic Load Balancing creates this role for you when you create a load balancer.

EKS正试图为您执行此操作，导致使用默认策略出现拒绝访问异常。

在创建EKS集群之前显式创建服务链接角色的其他选项包括：

AWS-CLI

aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"

Terraform

resource "aws_iam_service_linked_role" "elasticloadbalancing" {
aws_service_name = "elasticloadbalancing.amazonaws.com"
}

或者，从UI控制台手动创建负载均衡器。

不管配置选项如何，当您在AWS IAM 中看到以下角色时，您应该知道一切都会正常工作

arn:aws:iam::<ACCOUNT_ID>:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing

Answer 2

我通过将此策略添加到EKS角色来实现它：

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes"
],
"Resource": "*"
}
]
}