Creating the Amazon EKS node IAM role

To create your Amazon EKS node role in the IAM console

You can create the node IAM role with the AWS Management Console or the AWS CLI.

1. Open the IAM console at https://console.aws.amazon.com/iam/

2. In the left navigation pane, choose Roles.

3. On the Roles page, choose Create role.

4. On the Select trusted entity page, do the following:

   1. In the Trusted entity type section, choose AWS service.

   2. Under Use case, choose EC2.

   3. Choose Next.

5. On the Add permissions page, do the following:

   1. In the Filter policies box, enter AmazonEKSWorkerNodePolicy.

   2. Select the check box to the left of AmazonEKSWorkerNodePolicy in the search results.

   3. Choose Clear filters.

   4. In the Filter policies box, enter AmazonEC2ContainerRegistryReadOnly.

   5. Select the check box to the left of AmazonEC2ContainerRegistryReadOnly in the search results.

      Either the AmazonEKS_CNI_Policy managed policy, or an IPv6 policy that you create must also be attached to either this role or to a different role that's mapped to the aws-node Kubernetes service account. We recommend assigning the policy to the role associated to the Kubernetes service account instead of assigning it to this role. For more information, see Configuring the Amazon VPC CNI plugin for Kubernetes to use IAM roles for service accounts.

   6. Choose Next.

6. On the Name, review, and create page, do the following:

1. For Role name, enter a unique name for your role, such as AmazonEKSNodeRole.

2. For Description, replace the current text with descriptive text such as Amazon EKS - Node role in IAM console 

3. Under Add tags (Optional), add metadata to the role by attaching tags as key–value pairs. For more information about using tags in IAM, see Tagging IAM Entities in the IAM User Guide.

4. Choose Create role.

Make sure to use the same role whenever you're creating EKS node group in EKS cluster.