title: AWS EKS access issue on eks:AccessKubernetesApi
body: <p>I've created a new eks cluster using terraform , couple of developers when they try to access the cluster in aws console get the following error.</p>
  <p>Can someone pls point me what i'm missing.</p>
  <p>cluster version: 1.18</p>
  <pre><code>User: arn:aws:iam::xxxx:user/yyy is not authorized to perform: eks:AccessKubernetesApi on resource: arn:aws:eks:us-east-1:xxxx:cluster/cluster
  </code></pre>
  <p>Each user has this policy attached</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;eks:ListFargateProfiles&quot;,
                  &quot;eks:DescribeNodegroup&quot;,
                  &quot;eks:ListNodegroups&quot;,
                  &quot;eks:DescribeFargateProfile&quot;,
                  &quot;eks:ListTagsForResource&quot;,
                  &quot;eks:ListUpdates&quot;,
                  &quot;eks:DescribeUpdate&quot;,
                  &quot;eks:DescribeCluster&quot;,
                  &quot;eks:ListClusters&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>my aws-auth config looks</p>
  <pre><code>apiVersion: v1
  data:
    mapRoles: |
      - rolearn: arn:aws:iam::xxxx:role/cluster182020111918162137770000002f
        username: system:node:{{EC2PrivateDNSName}}
        groups:
          - system:bootstrappers
          - system:nodes
  
  
      - groups:
        - system:masters
        rolearn: arn:aws:iam::xxxx:role/abc-role
        username: abc-xac
      - groups:
        - system:bootstrappers
        - system:nodes
        rolearn: arn:aws:iam::xxx:role/cluster_eks_worker_role
        username: system:node:{{EC2PrivateDNSName}}
    mapUsers: |
      - groups:
        - system:developers
        userarn: arn:aws:iam::xxx:user/yyy
        username: yyy
  ....
  </code></pre>