Answers: <p>The only way to manage <code>IAM</code> users - using appropriate account with <code>IAM Administrator</code> privileges.</p>
  
  <p>See <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html" rel="nofollow noreferrer">AWS Identity and Access Management</a>
  If you lost your root account, you may contact an <code>AWS</code> support, see <a href="https://aws.amazon.com/premiumsupport/knowledge-center/recover-aws-password/?cu-additional-resource" rel="nofollow noreferrer">Recover Your AWS Account Password</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-05-09T10:24:42.453Z
Answers: 2020-05-09T10:24:42.453Z
Answers: Yasen
Answers: <p>As said in the question summary, the issue is that I have created an EKS cluster from IAM user that doesn't have programmatic access. I have tried what I have suggested as scenario that I would like to avoid.
  Only solution in this case was to create another IAM identity that will create the cluster and give it programmatic access.
  As I am a federated user from OKTA, I have admin rights but using the console on the created identity is a security bridge, so I have allowed it only to login, create the cluster and then disabled the console access.
  The from the newly created identity I could use kubectl to control the cluster and add other IAM identities from the auth configmap.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-05-11T08:47:59.247Z
Answers: 2020-05-11T08:47:59.247Z
Answers: anVzdGFub3RoZXJodW1hbg
Body: <p>I have no programmatic access for the user who created the cluster only graphical.
  I tried a lot of things and I always get access denied on kubectl as I have to use another IAM identity that has programmatic access.
  I assume there is some trick with STS but I don't have the access keys of the root account.
  I guess if I give graphic access to the IAM identity that I want to use, it will work out, but I want to know if there is a way with my current situation. Also using the aws-cli is not an option for creation in the given scenario.
  The admin who created my user won't allow my federated IAM to have access keys.</p>
  
Tags: <amazon-web-services><kubernetes><eks>
Title: EKS - created cluster from console with federated IAM admin - how to access
UserDisplayName: anVzdGFub3RoZXJodW1hbg
ThreadText: # EKS - created cluster from console with federated IAM admin - how to access
  
  (Asked by: username_0 on 2020-05-09)
  
  I have no programmatic access for the user who created the cluster only graphical.
  I tried a lot of things and I always get access denied on kubectl as I have to use another IAM identity that has programmatic access.
  I assume there is some trick with STS but I don't have the access keys of the root account.
  I guess if I give graphic access to the IAM identity that I want to use, it will work out, but I want to know if there is a way with my current situation. Also using the aws-cli is not an option for creation in the given scenario.
  The admin who created my user won't allow my federated IAM to have access keys.
  
  **Tags:** amazon-web-services, kubernetes, eks
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-05-09. Score: 1 | Accepted answer
  
  The only way to manage `IAM` users - using appropriate account with `IAM Administrator` privileges.
  
  See [AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html)
  If you lost your root account, you may contact an `AWS` support, see [Recover Your AWS Account Password](https://aws.amazon.com/premiumsupport/knowledge-center/recover-aws-password/?cu-additional-resource)
  
  
  ---
  
  ### Answer by username_0 on 2020-05-11. Score: 0
  
  As said in the question summary, the issue is that I have created an EKS cluster from IAM user that doesn't have programmatic access. I have tried what I have suggested as scenario that I would like to avoid.
  Only solution in this case was to create another IAM identity that will create the cluster and give it programmatic access.
  As I am a federated user from OKTA, I have admin rights but using the console on the created identity is a security bridge, so I have allowed it only to login, create the cluster and then disabled the console access.
  The from the newly created identity I could use kubectl to control the cluster and add other IAM identities from the auth configmap.
  
  
  ---
  
  