<p>This is actually pretty well described in the docs.</p>
<blockquote>
<p>Before you create worker nodes, you must create an IAM role with the
following IAM policies:</p>
<p>AmazonEKSWorkerNodePolicy</p>
<p>AmazonEKS_CNI_Policy</p>
<p>AmazonEC2ContainerRegistryReadOnly</p>
</blockquote>
<p>Also you need to make sure that this role could be assumed by EKS.</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
</code></pre>

CC BY-SA 4.0
2021-02-20T04:48:04.420Z
update the policy under "Trust Relationships".
CairoCoder
CC BY-SA 4.0
2023-04-01T09:28:27.057Z
Technically the role gets assumed by EC2 rather than EKS. Having said that I'm still having the issue the OP described even after following the documentation (and double checking with your answer). There must be something else somewhere that causes a problem with this in some situations...
Tim Malone
CC BY-SA 4.0
2023-04-01T09:47:57.310Z
Ah... the refresh button next to the role list only _pretends_ to refresh the roles. You have to actually hard refresh the page to see newly created roles. ‍♂️
Tim Malone
CC BY-SA 4.0
2020-05-29T21:48:16.560Z
2020-11-20T12:41:43.530Z
2020-11-20T12:41:43.530Z
Recoba20
<p>I've created a new EKS cluster, and am trying to add a new node group to it.</p>

<p>I'm stuck on selecting a Node IAM Role from the dropdown.</p>

<p><a href="https://i.sstatic.net/ga26g.png" rel="noreferrer"><img src="https://i.sstatic.net/ga26g.png" alt="node"></a></p>

<p>I followed the link, and created all options for roles I could see fit, still none appear in the dropdown.</p>

<p><a href="https://i.sstatic.net/vL6Vc.png" rel="noreferrer"><img src="https://i.sstatic.net/vL6Vc.png" alt="roles"></a></p>

<p>Note: currently I don't really care about restricting access, I'm only trying to run some POC against EKS with a test account.</p>

<aws-iam><role-based-access-control><eks>
Cannot configure node group in new EKS cluster due to no Node IAM role found
Mugen
# Cannot configure node group in new EKS cluster due to no Node IAM role found

(Asked by: username_0 on 2020-05-29)

I've created a new EKS cluster, and am trying to add a new node group to it.

I'm stuck on selecting a Node IAM Role from the dropdown.

[![node](https://i.sstatic.net/ga26g.png)](https://i.sstatic.net/ga26g.png)

I followed the link, and created all options for roles I could see fit, still none appear in the dropdown.

[![roles](https://i.sstatic.net/vL6Vc.png)](https://i.sstatic.net/vL6Vc.png)

Note: currently I don't really care about restricting access, I'm only trying to run some POC against EKS with a test account.

**Tags:** aws-iam, role-based-access-control, eks


---

## 1 answers

### Answer by username_1 on 2020-05-29. Score: 6 | Accepted answer

This is actually pretty well described in the docs.

Before you create worker nodes, you must create an IAM role with the
following IAM policies:
AmazonEKSWorkerNodePolicy
AmazonEKS_CNI_Policy
AmazonEC2ContainerRegistryReadOnly

Also you need to make sure that this role could be assumed by EKS.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

> **Comments:**
> **username_2**: update the policy under "Trust Relationships".  
> **username_3**: Technically the role gets assumed by EC2 rather than EKS. Having said that I'm still having the issue the OP described even after following the documentation (and double checking with your answer). There must be something else somewhere that causes a problem with this in some situations...  
> **username_3**: Ah... the refresh button next to the role list only _pretends_ to refresh the roles. You have to actually hard refresh the page to see newly created roles. ‍♂️  

---

