Associates an access policy and its scope to an access entry. For more information about associating access policies, see Associating and disassociating access policies to and from access entries in the Amazon EKS User Guide.
Request Syntax
POST /clusters/name/access-entries/principalArn/access-policies HTTP/1.1
Content-type: application/json
{
"accessScope": {
"namespaces": [ "string" ],
"type": "string"
},
"policyArn": "string"
}URI Request Parameters
The request uses the following URI parameters.
- name
-
The name of your cluster.
Required: Yes
- principalArn
-
The Amazon Resource Name (ARN) of the IAM user or role for the
AccessEntrythat you're associating the access policy to.Required: Yes
Request Body
The request accepts the following data in JSON format.
- accessScope
-
The scope for the
AccessPolicy. You can scope access policies to an entire cluster or to specific Kubernetes namespaces.Type: AccessScope object
Required: Yes
- policyArn
-
The ARN of the
AccessPolicythat you're associating. For a list of ARNs, useListAccessPolicies.Type: String
Required: Yes
Response Syntax
HTTP/1.1 200
Content-type: application/json
{
"associatedAccessPolicy": {
"accessScope": {
"namespaces": [ "string" ],
"type": "string"
},
"associatedAt": number,
"modifiedAt": number,
"policyArn": "string"
},
"clusterName": "string",
"principalArn": "string"
}Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- associatedAccessPolicy
-
The
AccessPolicyand scope associated to theAccessEntry.Type: AssociatedAccessPolicy object
- clusterName
-
The name of your cluster.
Type: String
- principalArn
-
The ARN of the IAM principal for the
AccessEntry.Type: String
Errors
For information about the errors that are common to all actions, see Common Errors.
- InvalidParameterException
-
The specified parameter is invalid. Review the available parameters for the API request.
HTTP Status Code: 400
- InvalidRequestException
-
The request is invalid given the state of the cluster. Check the state of the cluster and the associated operations.
HTTP Status Code: 400
- ResourceNotFoundException
-
The specified resource could not be found. You can view your available clusters with
ListClusters. You can view your available managed node groups withListNodegroups. Amazon EKS clusters and node groups are AWS Region specific.HTTP Status Code: 404
- ServerException
-
These errors are usually caused by a server-side issue.
HTTP Status Code: 500
Examples
In the following example or examples, the Authorization header contents
(AUTHPARAMS) must be replaced with an AWS Signature Version 4
signature. For more information about creating these signatures, see Signature
Version 4 Signing Process in the Amazon EKS General
Reference.
You need to learn how to sign HTTP requests only if you intend to manually
create them. When you use the AWS Command Line
Interface (AWS CLI)
Example
The following example associates the AmazonEKSAdminPolicy access
policy to an access entry with the IAM role named my-role. The
IAM role has the permissions in this policy across all namespaces on the
cluster.
Sample Request
POST /clusters/my-cluster/access-entries/arn%3Aaws%3Aiam%3A%3A012345678910%3Arole%2Fmy-role/access-policies HTTP/1.1
Host: eks.us-west-2.amazonaws.com
Accept-Encoding: identity
Content-Type: application/json
User-Agent: aws-cli/2.9.0 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/eks.associate-access-policy
X-Amz-Date: 20230531T134532Z
Authorization: AUTHPARAMS
Content-Length: 112
{
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy",
"accessScope": {
"type": "cluster"
}
}Sample Response
HTTP/1.1 200 OK
Date: Wed, 31 May 2023 13:45:47 GMT
Content-Type: application/json
Content-Length: 285
x-amzn-RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: *,Authorization,Date,X-Amz-Date,X-Amz-Security-Token,X-Amz-Target,content-type,x-amz-content-sha256,x-amz-user-agent,x-amzn-platform-id,x-amzn-trace-id
x-amz-apigw-id: FylbjHLcPHcFaiA=
Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE,OPTIONS
Access-Control-Expose-Headers: x-amzn-errortype,x-amzn-errormessage,x-amzn-trace-id,x-amzn-requestid,x-amz-apigw-id,date
X-Amzn-Trace-Id: Root=1-xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive
{
"clusterName": "my-cluster ",
"principalArn": "arn:aws:iam::012345678910:role/my-role",
"associatedAccessPolicy": {
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy",
"accessScope": {
"type": "cluster",
"namespaces": []
},
"associatedAt": 1685540747.281,
"modifiedAt": 1685540747.281
}
}See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
