title: Only the creator user can manage AWS kubernetes cluster (EKS) from kubectl?
body: <p>We have two clusters, named:</p>
  
  <ol>
  <li>MyCluster (created by me)</li>
  <li>OtherCluster (not created by me)</li>
  </ol>
  
  <p>Where "me" is my own AWS IAM user.</p>
  
  <p>I am able to manage the cluster I created, using kubectl:</p>
  
  <pre><code>&gt;&gt;&gt; aws eks update-kubeconfig --name MyCluster –profile MyUser
  &gt;&gt;&gt; kubectl get svc
  NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
  kubernetes   ClusterIP   172.20.0.1   &lt;none&gt;        443/TCP   59d
  </code></pre>
  
  <p>But, I cannot manage the “OtherCluster” cluster (that was not created by me):</p>
  
  <pre><code>&gt;&gt;&gt; aws eks update-kubeconfig --name OtherCluster --profile MyUser
  &gt;&gt;&gt; kubectl get svc
  NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
  error: the server doesn't have a resource type "svc"
  </code></pre>
  
  <p>After reading the feedback of some people experiencing the same issue in this <a href="https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/157" rel="nofollow noreferrer">github issue</a>, I tried doing this under the context of the user who originally created the "OtherCluster".</p>
  
  <p>I accomplished this by editing “~/.kube/config”, adding a “AWS_PROFILE” value at “users.user.env”. The profile represents the user who created the cluster.</p>
  
  <p>~/.kube/config:</p>
  
  <pre><code>…
  users
  - name: OtherCluster
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1alpha1
        args:
        - token
        - -i
        - OtherCluster
        command: aws-iam-authenticator
        env:
        - name: AWS_PROFILE
          value: OTHER_USER_PROFILE
  …
  </code></pre>
  
  <p>This worked:</p>
  
  <pre><code># ~/.kube/config is currently pointing to OtherCluster
  
  &gt;&gt;&gt; kubectl get svc 
  NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
  kubernetes   ClusterIP   172.20.0.1   &lt;none&gt;        443/TCP   1d
  </code></pre>
  
  <p>It is obviously not ideal for me to impersonate another person when I am managing the cluster. I would prefer to grant my own user access to manage the cluster via kubectl.
  Is there any way I can grant permission to manage the cluster to a user other than the original creator? This seems overly restrictive</p>