Recently I started experimenting with AWS. Following the least privilege principle, I created a separate development account for my experiments. Right at the beginning, I ran into a brick wall – AccessDenied! I know I am doing something wrong, but what exactly? This is where the AWS IAM Policy Simulator saved my day.
Let me first express my frustration with AWS IAM. It could be that I am naïve and that the problem with access management is really complex. Or it could be, that AWS built an overly complex solution and is now stuck with it. In both cases, there is no excuse for an official AWS tutorial about Elastic Kubernetes Service starting with the prerequisite that you grant yourself full access admin privileges. I decided to do it the right way and create a separate account with the least privileges it needs to work with EKS.