title: Kubernetes/kops: error attaching EBS volume to instance. You are not authorized to perform this operation. Error 403
body: <p>I tested kubernetes deployment with EBS volume mounting on AWS cluster provisioned by kops. This is deployment yml file:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    name: helloworld-deployment-volume
  spec:
    replicas: 1
    template:
      metadata:
        labels:
          app: helloworld
      spec:
        containers:
        - name: k8s-demo
          image: wardviaene/k8s-demo
          ports:
          - name: nodejs-port
            containerPort: 3000
          volumeMounts:
          - mountPath: /myvol
            name: myvolume
        volumes:
        - name: myvolume
          awsElasticBlockStore:
            volumeID: &lt;volume_id&gt;
  </code></pre>
  
  <p>After <code>kubectl create -f &lt;path_to_this_yml&gt;</code>, I got the following message in pod description:</p>
  
  <pre><code>Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation. status code: 403
  </code></pre>
  
  <p>Looks like this is just a permission issue. Ok, I checked policy for node role <code>IAM</code> -> <code>Roles</code> -> <code>nodes.&lt;my_domain&gt;</code> and found that there where no actions which allow to manipulate volumes, there was only <code>ec2:DescribeInstances</code> action by default. So I added <code>AttachVolume</code> and <code>DetachVolume</code> actions:</p>
  
  <pre><code>    {
          "Sid": "kopsK8sEC2NodePerms",
          "Effect": "Allow",
          "Action": [
              "ec2:DescribeInstances",
              "ec2:AttachVolume",
              "ec2:DetachVolume"
          ],
          "Resource": [
              "*"
          ]
      },
  </code></pre>
  
  <p>And this didn't help. I'm still getting that error:</p>
  
  <pre><code>Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation.
  </code></pre>
  
  <p>Am I missing something?</p>