What permissions to give to allow creating roles & EKS cluster?

I agree, the IAM role is a big problem. You can implement permission boundary for IAM role that will help. The IAM permission boundary is an IAM policy that defines the maximum permission a role, user can have. In the permission boundary, you can, for example, have a policy that says Deny deleteVPC, etc. Even if your main role allows deleting VPC, it will not succeed. Now, how can you enforce the use permission boundary. You have to make sure the user or service role that's creating this policy must attach the permission boundary.

Here's an example

- Sid: IAMPermission
            Effect: Allow
            Action:
              - 'iam:*'
            Resource: 'arn:aws:iam::*:role/*'
            Condition:
              'ForAllValues:ArnEquals':
                'iam:PermissionsBoundary': 'arn:aws:iam::*:policy/MyPermissionBoundary'

In this example, the user or service role that has "IAMPermission" policy can only create an IAM role when the specified permission boundary is attached.

To create and manage an Amazon EKS cluster with narrower permissions, you need to address several permission requirements while maintaining security.

For creating an EKS cluster, you need:

1. EKS-specific permissions: The user needs permissions to create and manage EKS clusters.

2. IAM role creation permissions: This is necessary because EKS requires a cluster IAM role with the AmazonEKSClusterPolicy. When creating a cluster, you need to:

• Create a role with EKS as the trusted entity
• Attach the AmazonEKSClusterPolicy to this role

3. EC2 permissions: For managing worker nodes and related resources.

4. Tagging permissions: For resource organization and management.

Instead of granting IAMFullAccess (which is too broad), you can use permissions boundaries to limit what the user can do with their role creation abilities. A permissions boundary is an IAM policy that sets the maximum permissions an IAM entity can have, regardless of what permissions are granted to them.

Here's how to implement this approach:

1. Create a permissions boundary policy that defines the maximum allowed permissions
2. Allow the user to create roles, but only with this permissions boundary attached
3. Ensure the boundary policy doesn't include permissions to modify boundaries or create admin-level access

This way, even if the user creates new roles, those roles cannot exceed the permissions defined in the boundary. The user won't be able to escalate privileges by creating roles with broader permissions than what you've allowed in the boundary policy.

For EKS specifically, you would:

• Allow creation of the EKS cluster role with the specific trust relationship to eks.amazonaws.com
• Allow attaching only the AmazonEKSClusterPolicy to this role
• Use conditions in your IAM policies to restrict which services can be trusted by created roles

This approach provides the necessary permissions for EKS cluster creation while preventing privilege escalation through role creation.
Sources
Amazon EKS cluster IAM role - Amazon EKS
Using roles for Amazon EKS clusters - Amazon EKS
How to Give AWS EKS IAM user access....? | AWS re:Post