Why can't I generate a kubeconfig file for my Amazon EKS cluster?
I get an AccessDeniedException error when I try to generate a kubeconfig file for an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.
"I get an AccessDeniedException error when I try to generate a kubeconfig file for an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.Short descriptionYou must have permission to use the eks:DescribeCluster API action with the cluster to generate a kubeconfig file for an Amazon EKS cluster. To get permission, attach an AWS Identity and Access Management (IAM) policy to an IAM user.ResolutionTo attach an IAM policy to an IAM user, complete the following steps:1.    Open the IAM console.2.    In the navigation pane, choose Users or Roles.3.    Select the name of the user or role to embed a policy in.4.    On the Permissions tab, choose Add inline policy.5.    Choose the JSON tab.6.    Use a text editor to replace the code with the following IAM policy:{   "Version": "2012-10-17",   "Statement": [       {             "Effect": "Allow",            "Action": [                "eks:DescribeCluster"            ],            "Resource": "*"       }    ]}7.    Choose Review policy.8.    For Name, enter a name for the policy. For example: eks_update-kubeconfig.Note: You can choose any name for the policy.9.    Choose Create policy.An explicit deny message indicates that if multi-factor authentication (MFA) is false, then there is an IAM policy that's denying most actions:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "BlockMostAccessUnlessSignedInWithMFA",      "Effect": "Deny",      "NotAction": [        "iam:CreateVirtualMFADevice",        "iam:EnableMFADevice",        "iam:ListMFADevices",        "iam:ListUsers",        "iam:ListVirtualMFADevices",        "iam:ResyncMFADevice",        "sts:GetSessionToken"      ],      "Resource": "*",      "Condition": {        "BoolIfExists": {          "aws:MultiFactorAuthPresent": "false"        }      }    }  ]}Note: Because you use an MFA device, you must use an MFA token to authenticate access to AWS resources with the AWS Command Line Interface (AWS CLI). Follow the steps in the article How do I use an MFA token to authenticate access to my AWS resources through the AWS CLI? Then, run the sts get-session-token AWS CLI command.For example:$ aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-tokenNote: Replace arn-of-the-mfa-device with the ARN of your MFA device and code-from-token with your token's code.You can use temporary credentials by exporting the values to environment variables.For example:$ export AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-output$ export AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-output$ export AWS_SESSION_TOKEN=example-session-token-as-in-previous-outputRun the update-kubeconfig command and confirm that it updates the config file under ~/.kube/config:aws eks --region region-code update-kubeconfig --name cluster_nameNote: Replace region-code with your AWS Region's code and cluster name with your cluster's name.Follow"