Console
    Contact Us Start free

    AWS IAM role list

    The tables on this page list all of the permissions used in creating the default AWS IAM roles. To create these policies with default permissions, see Create AWS IAM roles .

    GKE Multi-Cloud API service agent role
    The GKE Multi-Cloud API uses this AWS IAM role to manage resources using AWS APIs. This role is used by a Google-managed service account known as a service agent .
    Control plane AWS IAM role
    Your cluster control plane uses this role to control node pools.
    Node pool AWS IAM role
    The control plane uses this role to create node pool VMs.

    Depending upon your organization's requirements, you can choose to create custom AWS IAM policies for GKE on AWS to manage your clusters. These policies will replace the default versions. You then apply these policies to AWS IAM roles and provide them when you create a cluster.

    For more information on the purpose of each role, see AWS IAM roles for GKE on AWS .

    To create these policies, choose the level that you wish to restrict your resources at. For example, you can restrict a policy to a particular AWS VPC using the VPC's Amazon Resource Name (ARN). For more information, see Controlling access to AWS resources using policies .

    IAM policies for GKE Multi-Cloud service agents

    Resource Type
    ARN
    Permission Required
    Purpose
    Reference
    Security Group
    arn:aws:ec2:*:*:security-group/sg-*
    ec2:DescribeSecurityGroups (Create, Update, Delete)
    ec2:CreateSecurityGroup (Create)
    ec2:CreateTags (Create)
    ec2:RevokeSecurityGroupEgress (Create)
    ec2:DeleteSecurityGroup (Delete)
    Control plane security group
    Security Group
    Node pool security group
    Security Group Rule
    arn:aws:ec2:*:*:security-group-rule/sgr-*
    ec2:AuthorizeSecurityGroupEgress (Create)
    ec2:RevokeSecurityGroupEgress (Delete)
    ec2:CreateTags (Create)
    Control plane egress security group rule
    Security Group Rule
    ec2:AuthorizeSecurityGroupIngress (Create)
    ec2:RevokeSecurityGroupIngress (Delete)
    ec2:CreateTags (Create)
    Control plane ingress security group rule
    Security Group Rule
    ec2:AuthorizeSecurityGroupEgress (Create)
    ec2:RevokeSecurityGroupEgress (Delete)
    ec2:CreateTags (Create)
    Control plane egress security group rule
    Security Group Rule
    ec2:AuthorizeSecurityGroupIngress (Create)
    ec2:RevokeSecurityGroupIngress (Delete)
    ec2:CreateTags (Create)
    Control plane ingress security group rule
    Network Load Balancer
    arn:aws:elasticloadbalancing:*:*:loadbalancer/net/gke-*
    elasticloadbalancing:DescribeLoadBalancers (Create, Delete)
    elasticloadbalancing:CreateLoadBalancer (Create)
    ec2:CreateSecurityGroup (Create)
    ec2:DescribeAccountAttributes (Create)
    ec2:DescribeInternetGateways (Create)
    ec2:DescribeSecurityGroups (Create)
    ec2:DescribeSubnets (Create)
    ec2:DescribeVpcs (Create)
    iam:CreateServiceLinkedRole (Create)
    elasticloadbalancing:DeleteLoadBalancer (Delete)
    Kubernetes api-server load balancer
    Elastic Load Balancing API permissions
    Target Group
    arn:aws:elasticloadbalancing:*:*:targetgroup/gke-*
    elasticloadbalancing:DescribeTargetGroups (Create, Update, Delete)
    elasticloadbalancing:DescribeTargetHealth (Create, Update)
    elasticloadbalancing:CreateTargetGroup (Create)
    elasticloadbalancing:ModifyTargetGroupAttributes (Create)
    ec2:DescribeInternetGateways (Create)
    ec2:DescribeVpcs (Create)
    elasticloadbalancing:DeleteTargetGroup (Delete)
    Target group for https
    Elastic Load Balancing API permissions
    Target Group
    Target group for https for konnectivity agent
    Listener
    arn:aws:elasticloadbalancing:*:*:listener/net/gke-*
    elasticloadbalancing:CreateListener (Create)
    elasticloadbalancing:DeleteListener (Delete) elasticloadbalancing:DescribeListeners (Delete)
    elasticloadbalancing:DeleteListener (Delete)
    Listener for https
    Listener
    Listener for https for konnectivity agent
    Volume
    arn:aws:ec2:*:*:volume/vol-*
    ec2:CreateVolume (Create)
    ec2:CreateTags (Create)
    ec2:DeleteVolume (Delete)
    etcd volumes
    Network Interface
    arn:aws:ec2:*:*:network-interface/eni-*
    ec2:DescribeNetworkInterfaces Update
    ec2:CreateNetworkInterface (Create)
    ec2:CreateTags (Create)
    ec2:ModifyNetworkInterfaceAttribute (Update)
    ec2:DeleteNetworkInterface (Delete)
    etcd NICs
    Launch Template
    arn:aws:ec2:*:*:launch-template/lt-*
    ec2:CreateLaunchTemplate (Create, Update)
    ec2:CreateTags (Create, Update)
    ec2:DeleteLaunchTemplate (Delete)
    Launch template for control plane instances
    Launch Template
    Launch template for node pool instances
    Auto Scaling Group
    arn:aws:autoscaling:*:*:autoScalingGroup:*: autoScalingGroupName/gke-*
    autoscaling:DescribeAutoScalingGroups (Create, Update, Delete)
    autoscaling:CreateAutoScalingGroup (Create)
    autoscaling:CreateOrUpdateTags (Update)
    autoscaling:UpdateAutoScalingGroup (Update, Delete)
    autoscaling:TerminateInstanceInAutoScalingGroup (Update)
    autoscaling:DeleteTags Update, (Delete)
    autoscaling:DeleteAutoScalingGroup (Delete)
    iam:CreateServiceLinkedRole (Create)
    ec2:RunInstances (Create)
    iam:PassRole （Create）
    auto scaling groups for control plane instances
    Required API permissions for Amazon EC2 Auto Scaling
    Auto Scaling Group
    arn:aws:autoscaling:*:*:autoScalingGroup:*: autoScalingGroupName/gke-*
    auto scaling groups for node pool instances
    Required permissions to create a service-linked role
    EC2 key pairs
    ec2:DescribeKeyPairs (Create)
    To ensure the EC2 key pair used to login into cluster machines exists.
    Subnets
    ec2:DescribeSubnets (Create)
    Access to additional subnets in your VPC
    VPC
    ec2:DescribeVpcs (Create)
    Information on your AWS VPC
    EC2 Console output
    ec2:GetConsoleOutput (Create, Update)
    Check console logs for errors
    KMS Key
    For more information on KMS key policies for GKE on AWS Creating KMS keys with specific permissions

    IAM policy for control plane role

    Purpose
    Permission Required
    Reference
    cluster autoscaler
    autoscaling:DescribeAutoScalingGroups (Create, Update)
    autoscaling:DescribeAutoScalingInstances (Create, Update)
    autoscaling:DescribeLaunchConfigurations (Create, Update)
    autoscaling:DescribeTags (Create, Update)
    ec2:DescribeInstanceTypes (Create, Update)
    ec2:DescribeLaunchTemplateVersions (Create, Update)
    autoscaling:SetDesiredCapacity
    autoscaling:TerminateInstanceInAutoScalingGroup
    https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md
    cloud-provider-aws
    autoscaling:DescribeAutoScalingGroups
    autoscaling:DescribeLaunchConfigurations
    autoscaling:DescribeTags (Create)
    ec2:DescribeInstances (Create)
    ec2:DescribeRegions
    ec2:DescribeRouteTables
    ec2:DescribeSecurityGroups
    ec2:DescribeSubnets
    ec2:DescribeVolumes
    ec2:CreateSecurityGroup
    ec2:CreateTags
    ec2:CreateVolume
    ec2:ModifyInstanceAttribute
    ec2:ModifyVolume
    ec2:AttachVolume (Create)
    ec2:AuthorizeSecurityGroupIngress
    ec2:CreateRoute
    ec2:DeleteRoute
    ec2:DeleteSecurityGroup
    ec2:DeleteVolume
    ec2:DetachVolume
    ec2:RevokeSecurityGroupIngress
    ec2:DescribeVpcs
    elasticloadbalancing:AddTags
    elasticloadbalancing:AttachLoadBalancerToSubnets
    elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
    elasticloadbalancing:CreateLoadBalancer
    elasticloadbalancing:CreateLoadBalancerPolicy
    elasticloadbalancing:CreateLoadBalancerListeners
    elasticloadbalancing:ConfigureHealthCheck
    elasticloadbalancing:DeleteLoadBalancer
    elasticloadbalancing:DeleteLoadBalancerListeners
    elasticloadbalancing:DescribeLoadBalancers
    elasticloadbalancing:DescribeLoadBalancerAttributes
    elasticloadbalancing:DetachLoadBalancerFromSubnets
    elasticloadbalancing:DeregisterInstancesFromLoadBalancer
    elasticloadbalancing:ModifyLoadBalancerAttributes
    elasticloadbalancing:RegisterInstancesWithLoadBalancer
    elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer
    elasticloadbalancing:AddTags
    elasticloadbalancing:CreateListener
    elasticloadbalancing:CreateTargetGroup
    elasticloadbalancing:DeleteListener
    elasticloadbalancing:DeleteTargetGroup
    elasticloadbalancing:DescribeListeners
    elasticloadbalancing:DescribeLoadBalancerPolicies
    elasticloadbalancing:DescribeTargetGroups
    elasticloadbalancing:DescribeTargetHealth
    elasticloadbalancing:ModifyListener
    elasticloadbalancing:ModifyTargetGroup
    elasticloadbalancing:RegisterTargets
    elasticloadbalancing:DeregisterTargets
    elasticloadbalancing:SetLoadBalancerPoliciesOfListener
    iam:CreateServiceLinkedRole
    kms:DescribeKey

    https://github.com/kubernetes/cloud-provider-aws/blob/master/docs/prerequisites.md
    Create load balancers
    elasticloadbalancing:CreateLoadBalancer
    ec2:DescribeAccountAttributes
    ec2:DescribeInternetGateways
    ec2:DescribeSecurityGroups
    ec2:DescribeSubnets
    ec2:DescribeVpcs
    https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/elb-api-permissions.html
    aws-ebs-csi-driver
    ec2:DescribeVolumesModifications
    ec2:DeleteTags
    ec2:DescribeAvailabilityZones

    https://github.com/kubernetes-sigs/aws-ebs-csi-driver/tree/master/docs#set-up-driver-permission
    gke-aws-controller-manager
    ec2:DescribeDhcpOptions
    ec2:DescribeInstances
    ec2:DescribeVpcs
    elasticloadbalancing:ModifyTargetGroupAttributes
    ec2:DescribeSnapshots
    ec2:CreateSnapshot
    ec2:DeleteSnapshot
    CSI snapshotter
    Kubernetes external snapshotter
    GKE on AWS node agent
    Attach NIC to etcd
    ec2:AttachNetworkInterface (Create, Update)
    Read proxy configuration from Secrets Manager
    secretsmanager:GetSecretValue (Create, Update)
    Interact with KMS keys
    kms:Encrypt (Create, Update)
    kms:Decrypt (Create, Update)
    kms:CreateGrant (Create, Update)

    IAM policy for node pool role

    Purpose Permission Required Reference
    Read proxy configuration from secrets manager
    		 secretsmanager:GetSecretValue (Create, Update)
    KMS key to decrypt node pool configuration encryption
    		 kms:Decrypt (Create, Update) Create an AWS KMS key
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: