<p>The only way to manage <code>IAM</code> users - using appropriate account with <code>IAM Administrator</code> privileges.</p>

<p>See <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html" rel="nofollow noreferrer">AWS Identity and Access Management</a>
If you lost your root account, you may contact an <code>AWS</code> support, see <a href="https://aws.amazon.com/premiumsupport/knowledge-center/recover-aws-password/?cu-additional-resource" rel="nofollow noreferrer">Recover Your AWS Account Password</a></p>

CC BY-SA 4.0
2020-05-09T10:24:42.453Z
2020-05-09T10:24:42.453Z
Yasen
<p>As said in the question summary, the issue is that I have created an EKS cluster from IAM user that doesn't have programmatic access. I have tried what I have suggested as scenario that I would like to avoid.
Only solution in this case was to create another IAM identity that will create the cluster and give it programmatic access.
As I am a federated user from OKTA, I have admin rights but using the console on the created identity is a security bridge, so I have allowed it only to login, create the cluster and then disabled the console access.
The from the newly created identity I could use kubectl to control the cluster and add other IAM identities from the auth configmap.</p>

CC BY-SA 4.0
2020-05-11T08:47:59.247Z
2020-05-11T08:47:59.247Z
anVzdGFub3RoZXJodW1hbg
<p>I have no programmatic access for the user who created the cluster only graphical.
I tried a lot of things and I always get access denied on kubectl as I have to use another IAM identity that has programmatic access.
I assume there is some trick with STS but I don't have the access keys of the root account.
I guess if I give graphic access to the IAM identity that I want to use, it will work out, but I want to know if there is a way with my current situation. Also using the aws-cli is not an option for creation in the given scenario.
The admin who created my user won't allow my federated IAM to have access keys.</p>

<amazon-web-services><kubernetes><eks>
EKS - created cluster from console with federated IAM admin - how to access
anVzdGFub3RoZXJodW1hbg
# EKS - created cluster from console with federated IAM admin - how to access

(Asked by: username_0 on 2020-05-09)

I have no programmatic access for the user who created the cluster only graphical.
I tried a lot of things and I always get access denied on kubectl as I have to use another IAM identity that has programmatic access.
I assume there is some trick with STS but I don't have the access keys of the root account.
I guess if I give graphic access to the IAM identity that I want to use, it will work out, but I want to know if there is a way with my current situation. Also using the aws-cli is not an option for creation in the given scenario.
The admin who created my user won't allow my federated IAM to have access keys.

**Tags:** amazon-web-services, kubernetes, eks


---

## 2 answers

### Answer by username_1 on 2020-05-09. Score: 1 | Accepted answer

The only way to manage `IAM` users - using appropriate account with `IAM Administrator` privileges.

See [AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html)
If you lost your root account, you may contact an `AWS` support, see [Recover Your AWS Account Password](https://aws.amazon.com/premiumsupport/knowledge-center/recover-aws-password/?cu-additional-resource)


---

### Answer by username_0 on 2020-05-11. Score: 0

As said in the question summary, the issue is that I have created an EKS cluster from IAM user that doesn't have programmatic access. I have tried what I have suggested as scenario that I would like to avoid.
Only solution in this case was to create another IAM identity that will create the cluster and give it programmatic access.
As I am a federated user from OKTA, I have admin rights but using the console on the created identity is a security bridge, so I have allowed it only to login, create the cluster and then disabled the console access.
The from the newly created identity I could use kubectl to control the cluster and add other IAM identities from the auth configmap.


---

