In order for Kubernetes to make use of its integrations with the AWS cloud APIs, we need to set up IAM instance profiles. An instance profile is a way for the Kubernetes software to authenticate with the AWS API, and for us to assign fine-grained permissions on the actions that Kubernetes can take.
It can be confusing to learn all of the permissions that Kubernetes requires to function correctly. You could just set up instance profiles that allow full access to AWS, but this would be at the expense of security best practice.
Whenever we assign security permissions, we should be aiming to grant just enough permissions for our software to function correctly. To this end, I have collated a set of minimal IAM policies that will allow our cluster to function correctly, without giving excess permissions away.
You can view these policies at https://github.com/errm/k8s...