AWS managed policies for Amazon Elastic Kubernetes Service

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they’re available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: AmazonEKS_CNI_Policy

You can attach the AmazonEKS_CNI_Policy to your IAM entities. Before you create an Amazon EC2 node group, this policy must be attached to either the node IAM role, or to an IAM role that’s used specifically by the Amazon VPC CNI plugin for Kubernetes. This is so that it can perform actions on your behalf. We recommend that you attach the policy to a role that’s used only by the plugin. For more information, see Assign IPs to Pods with the Amazon VPC CNI and Configure Amazon VPC CNI plugin to use IRSA.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks:

ec2:*NetworkInterface and ec2:*PrivateIpAddresses – Allows the Amazon VPC CNI plugin to perform actions such as provisioning Elastic Network Interfaces and IP addresses for Pods to provide networking for applications that run in Amazon EKS.
ec2 read actions – Allows the Amazon VPC CNI plugin to perform actions such as describe instances and subnets to see the amount of free IP addresses in your Amazon VPC subnets. The VPC CNI can use the free IP addresses in each subnet to pick the subnets with the most free IP addresses to use when creating an elastic network interface.

To view the latest version of the JSON policy document, see AmazonEKS_CNI_Policy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSClusterPolicy

You can attach AmazonEKSClusterPolicy to your IAM entities. Before creating a cluster, you must have a cluster IAM role with this policy attached. Kubernetes clusters that are managed by Amazon EKS make calls to other AWS services on your behalf. They do this to manage the resources that you use with the service.

This policy includes the following permissions that allow Amazon EKS to complete the following tasks:

autoscaling – Read and update the configuration of an Auto Scaling group. These permissions aren’t used by Amazon EKS but remain in the policy for backwards compatibility.
ec2 – Work with volumes and network resources that are associated to Amazon EC2 nodes. This is required so that the Kubernetes control plane can join instances to a cluster and dynamically provision and manage Amazon EBS volumes that are requested by Kubernetes persistent volumes.
ec2 - Delete elastic network interfaces that are created by the VPC CNI. This is required so that EKS can clean up elastic network interfaces that are left behind if the VPC CNI quits unexpectedly.
elasticloadbalancing – Work with Elastic Load Balancers and add nodes to them as targets. This is required so that the Kubernetes control plane can dynamically provision Elastic Load Balancers requested by Kubernetes services.
iam – Create a service-linked role. This is required so that the Kubernetes control plane can dynamically provision Elastic Load Balancers that are requested by Kubernetes services.
kms – Read a key from AWS KMS. This is required for the Kubernetes control plane to support secrets encryption of Kubernetes secrets stored in etcd.

To view the latest version of the JSON policy document, see AmazonEKSClusterPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSDashboardConsoleReadOnly

You can attach AmazonEKSDashboardConsoleReadOnly to your IAM entities.

This policy includes the following permissions that allow Amazon EKS to complete the following tasks:

eks - Read-only access to EKS dashboard data, resources, and cluster versions information. This allows viewing EKS-related metrics and cluster configuration details.
organizations - Read-only access to AWS Organizations information, including:
- Viewing organization details and service access
- Listing organizational roots, accounts, and organizational units
- Viewing organization structure

To view the latest version of the JSON policy document, see AmazonEKSDashboardConsoleReadOnly in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSFargatePodExecutionRolePolicy

You can attach AmazonEKSFargatePodExecutionRolePolicy to your IAM entities. Before you can create a Fargate profile, you must create a Fargate Pod execution role and attach this policy to it. For more information, see Step 2: Create a Fargate Pod execution role and Define which Pods use AWS Fargate when launched.

This policy grants the role the permissions that provide access to other AWS service resources that are required to run Amazon EKS Pods on Fargate.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks:

ecr – Allows Pods that are running on Fargate to pull container images that are stored in Amazon ECR.

To view the latest version of the JSON policy document, see AmazonEKSFargatePodExecutionRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSConnectorServiceRolePolicy

You can’t attach AmazonEKSConnectorServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see Using roles to connect a Kubernetes cluster to Amazon EKS.

The role allows Amazon EKS to connect Kubernetes clusters. The attached policies allow the role to manage necessary resources to connect to your registered Kubernetes cluster.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks.

SSM Management – Create, describe, and delete SSM activations, and deregister managed instances. This allows basic Systems Manager operations.
Session Management – Start SSM sessions specifically for EKS clusters and execute non-interactive commands using the AmazonEKS document.
IAM Role Passing – Pass IAM roles specifically to the SSM service, controlled by a condition that restricts the passed roles to ssm.amazonaws.com.
EventBridge Rules – Create EventBridge rules and targets, but only when managed by eks-connector.amazonaws.com. Rules are specifically limited to AWS SSM as the event source.

To view the latest version of the JSON policy document, see AmazonEKSConnectorServiceRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSForFargateServiceRolePolicy

You can’t attach AmazonEKSForFargateServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see AWSServiceRoleForAmazonEKSForFargate.

This policy grants necessary permissions to Amazon EKS to run Fargate tasks. The policy is only used if you have Fargate nodes.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks.

ec2 – Create and delete Elastic Network Interfaces and describe Elastic Network Interfaces and resources. This is required so that the Amazon EKS Fargate service can configure the VPC networking that’s required for Fargate Pods.

To view the latest version of the JSON policy document, see AmazonEKSForFargateServiceRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSComputePolicy

You can attach AmazonEKSComputePolicy to your IAM entities. You may attach this policy to your cluster IAM role to expand the resources EKS can manage in your account.

This policy grants the permissions required for Amazon EKS to create and manage EC2 instances for the EKS cluster, and the necessary IAM permissions to configure EC2. Also, this policy grants the permissions for Amazon EKS to create the EC2 Spot service-linked role on your behalf.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks:

ec2 Permissions:
- ec2:CreateFleet and ec2:RunInstances - Allows creating EC2 instances and using specific EC2 resources (images, security groups, subnets, on-demand capacity reservations, placement groups) for EKS cluster nodes.
- ec2:CreateLaunchTemplate - Allows creating EC2 launch templates for EKS cluster nodes.
- The policy also includes conditions to restrict the use of these EC2 permissions to resources tagged with the EKS cluster name and other relevant tags.
- ec2:CreateTags - Allows adding tags to EC2 resources created by the CreateFleet, RunInstances, and CreateLaunchTemplate actions.
- ec2:DescribeCapacityReservations - Allows creating EC2 instances from Interruptible Capacity Reservations
iam Permissions:
- iam:AddRoleToInstanceProfile - Allows adding an IAM role to the EKS compute instance profile.
- iam:PassRole - Allows passing the necessary IAM roles to the EC2 service.

To view the latest version of the JSON policy document, see AmazonEKSComputePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSNetworkingPolicy

You can attach AmazonEKSNetworkingPolicy to your IAM entities. You may attach this policy to your cluster IAM role to expand the resources EKS can manage in your account.

This policy is designed to grant the necessary permissions for Amazon EKS to create and manage network interfaces for the EKS cluster, allowing the control plane and worker nodes to communicate and function properly.

Permissions details

This policy grants the following permissions to allow Amazon EKS to manage network interfaces for the cluster:

ec2 Network Interface Permissions:
- ec2:CreateNetworkInterface - Allows creating EC2 network interfaces.
- The policy includes conditions to restrict the use of this permission to network interfaces tagged with the EKS cluster name and the Kubernetes CNI node name.
- ec2:CreateTags - Allows adding tags to the network interfaces created by the CreateNetworkInterface action.
ec2 Network Interface Management Permissions:
- ec2:AttachNetworkInterface, ec2:ModifyNetworkInterfaceAttribute, ec2:DetachNetworkInterface - Allows attaching, modifying network interface attributes and detaching network interfaces to EC2 instances.
- ec2:UnassignPrivateIpAddresses, ec2:UnassignIpv6Addresses, ec2:AssignPrivateIpAddresses, ec2:AssignIpv6Addresses - Allows managing the IP address assignments of the network interfaces.
- These permissions are restricted to network interfaces tagged with the EKS cluster name.

To view the latest version of the JSON policy document, see AmazonEKSNetworkingPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSBlockStoragePolicyV2

You can attach AmazonEKSBlockStoragePolicyV2 to your IAM entities. You can attach this policy to your cluster IAM role to expand the resources EKS can manage in your account.

This policy grants the necessary permissions for Amazon EKS to create, manage, and maintain EC2 volumes and snapshots for the EKS cluster, enabling the control plane and worker nodes to provision and use persistent storage as required by Kubernetes workloads.

Permissions details

This IAM policy grants the following permissions to allow Amazon EKS to manage EC2 volumes and snapshots:

ec2 Volume Management Permissions:
- ec2:AttachVolume, ec2:DetachVolume, ec2:ModifyVolume, ec2:EnableFastSnapshotRestores - Allows attaching, detaching, modifying, and enabling fast snapshot restores for EC2 volumes.
- These permissions are restricted to volumes tagged with the EKS cluster name.
- ec2:CreateTags - Allows adding tags to the EC2 volumes and snapshots created by the CreateVolume and CreateSnapshot actions.
ec2 Volume Creation Permissions:
- ec2:CreateVolume - Allows creating new EC2 volumes.
- The policy includes conditions to restrict the use of this permission to volumes tagged with the EKS cluster name and other relevant tags.
- ec2:CreateSnapshot - Allows creating new EC2 volume snapshots.
- The policy includes conditions to restrict the use of this permission to snapshots tagged with the EKS cluster name and other relevant tags.

To view the latest version of the JSON policy document, see AmazonEKSBlockStoragePolicyV2 in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSLoadBalancingPolicy

You can attach AmazonEKSLoadBalancingPolicy to your IAM entities. You may attach this policy to your cluster IAM role to expand the resources EKS can manage in your account.

This IAM policy grants the necessary permissions for Amazon EKS to work with various AWS services to manage Elastic Load Balancers (ELBs) and related resources.

Permissions details

The key permissions granted by this policy are:

elasticloadbalancing : Allows creating, modifying, and managing Elastic Load Balancers and Target Groups. This includes permissions to create, update, and delete load balancers, target groups, listeners, and rules.
ec2 : Allows creating and managing security groups, which are required for the Kubernetes control plane to join instances to a cluster and manage Amazon EBS volumes. Also allows describing and listing EC2 resources such as instances, VPCs, Subnets, Security Groups, and other networking resources.
iam : Allows creating a service-linked role for Elastic Load Balancing, which is required for the Kubernetes control plane to dynamically provision ELBs.
kms : Allows reading a key from AWS KMS, which is required for the Kubernetes control plane to support encryption of Kubernetes secrets stored in etcd.
wafv2 and shield : Allows listing, associating, and disassociating Web ACLs and creating/deleting AWS Shield protections for the Elastic Load Balancers.
cognito-idp , acm , and elasticloadbalancing : Grants permissions to describe user pool clients, list and describe certificates, and describe target groups, which are required for the Kubernetes control plane to manage the Elastic Load Balancers.

The policy also includes several condition checks to ensure that the permissions are scoped to the specific EKS cluster being managed, using the eks:eks-cluster-name tag.

To view the latest version of the JSON policy document, see AmazonEKSLoadBalancingPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSMCPReadOnlyAccess

You can attach AmazonEKSMCPReadOnlyAccess to your IAM entities. This policy provides read-only access to Amazon EKS resources and related AWS services, enabling the Amazon EKS Model Context Protocol (MCP) Server to perform observability and troubleshooting operations without making any modifications to your infrastructure.

Permissions details

This policy includes the following permissions that allow principals to complete the following tasks:

eks – Allows principals to describe and list EKS clusters, node groups, add-ons, access entries, insights, and access the Kubernetes API for read-only operations.
iam – Allows principals to retrieve information about IAM roles, policies, and their attachments to understand the permissions associated with EKS resources.
ec2 – Allows principals to describe VPCs, subnets, and route tables to understand the network configuration of EKS clusters.
sts – Allows principals to retrieve caller identity information for authentication and authorization purposes.
logs – Allows principals to start queries and retrieve query results from CloudWatch Logs for troubleshooting and monitoring.
cloudwatch – Allows principals to retrieve metric data for monitoring cluster and workload performance.
eks-mcp – Allows principals to invoke MCP operations and call read-only tools within the Amazon EKS MCP Server.

To view the latest version of the JSON policy document, see AmazonEKSMCPReadOnlyAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSServicePolicy

You can attach AmazonEKSServicePolicy to your IAM entities. Clusters that were created before April 16, 2020, required you to create an IAM role and attach this policy to it. Clusters that were created on or after April 16, 2020, don’t require you to create a role and don’t require you to assign this policy. When you create a cluster using an IAM principal that has the iam:CreateServiceLinkedRole permission, the AWSServiceRoleForAmazonEKS service-linked role is automatically created for you. The service-linked role has the managed policy: AmazonEKSServiceRolePolicy attached to it.

This policy allows Amazon EKS to create and manage the necessary resources to operate Amazon EKS clusters.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks.

eks – Update the Kubernetes version of your cluster after you initiate an update. This permission isn’t used by Amazon EKS but remains in the policy for backwards compatibility.
ec2 – Work with Elastic Network Interfaces and other network resources and tags. This is required by Amazon EKS to configure networking that facilitates communication between nodes and the Kubernetes control plane. Read information about security groups. Update tags on security groups.
route53 – Associate a VPC with a hosted zone. This is required by Amazon EKS to enable private endpoint networking for your Kubernetes cluster API server.
logs – Log events. This is required so that Amazon EKS can ship Kubernetes control plane logs to CloudWatch.
iam – Create a service-linked role. This is required so that Amazon EKS can create the Service-linked role permissions for Amazon EKS service-linked role on your behalf.

To view the latest version of the JSON policy document, see AmazonEKSServicePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonEKSServiceRolePolicy

You can’t attach AmazonEKSServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see Service-linked role permissions for Amazon EKS. When you create a cluster using an IAM principal that has the iam:CreateServiceLinkedRole permission, the AWSServiceRoleForAmazonEKS service-linked role is automatically created for you and this policy is attached to it.

This policy allows the service-linked role to call AWS services on your behalf.

Permissions details

This policy includes the following permissions that allow Amazon EKS to complete the following tasks.

ec2 – Create and describe Elastic Network Interfaces, Amazon EC2 instances and their statuses, the cluster security group, and VPC that are required to create a cluster. For more information, see