Additional IAM Policies for Specific Use Cases

The following sections list additional Identity and Access Management (IAM) policies that may be required for specific use cases.

Controllers EKS Policy

If you plan to deploy Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) host clusters, make sure to attach the PaletteControllersEKSPolicy on top of the Core IAM Policies.

If you are using the Minimum Permissions Policies for EKS (static or dynamic), this is not required.

Keep iam:TagRole and iam:UntagRole in this policy, even if a policy audit reports them as unused. AWS CloudFormation, not Palette, uses these actions to tag the IAM roles in the CloudFormation stack that Palette uses, and stack updates fail without them.

Last Update: November 3, 2026

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["ssm:GetParameter"],
      "Resource": ["arn:*:ssm:*:*:parameter/aws/service/eks/optimized-ami/*"],
      "Effect": "Allow"
    },
    {
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "eks.amazonaws.com"
        }
      },
      "Action": ["iam:CreateServiceLinkedRole"],
      "Resource": [
        "arn:*:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS"
      ],
      "Effect": "Allow"
    },
    {
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "eks-nodegroup.amazonaws.com"
        }
      },
      "Action": ["iam:CreateServiceLinkedRole"],
      "Resource": [
        "arn:*:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
      ],
      "Effect": "Allow"
    },
    {
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "eks-fargate.amazonaws.com"
        }
      },
      "Action": ["iam:CreateServiceLinkedRole"],
      "Resource": [
        "arn:*:iam::*:role/aws-service-role/eks-fargate-pods.amazonaws.com/AWSServiceRoleForAmazonEKSForFargate"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:AddClientIDToOpenIDConnectProvider",
        "iam:CreateOpenIDConnectProvider",
        "iam:DeleteOpenIDConnectProvider",
        "iam:ListOpenIDConnectProviders",
        "iam:UpdateOpenIDConnectProviderThumbprint",
        "iam:GetOpenIDConnectProvider",
        "iam:TagOpenIDConnectProvider"
      ],
      "Resource": ["*"],
      "Effect": "Allow"
    },
    {
      "Action": [
        "eks:CreateAccessEntry",
        "eks:DeleteAccessEntry",
        "eks:DescribeAccessEntry",
        "eks:UpdateAccessEntry",
        "eks:ListAccessEntries",
        "eks:AssociateAccessPolicy",
        "eks:DisassociateAccessPolicy",
        "eks:ListAssociatedAccessPolicies"
      ],
      "Resource": ["*"],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:GetRole",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:DetachRolePolicy",
        "iam:DeleteRole",
        "iam:CreateRole",
        "iam:TagRole",
        "iam:UntagRole",
        "iam:AttachRolePolicy"
      ],
      "Resource": ["arn:*:iam::*:role/*"],
      "Effect": "Allow"
    },
    {
      "Action": ["iam:ListRoles"],
      "Resource": ["*"],
      "Effect": "Allow"
    },
    {
      "Action": ["iam:PutRolePolicy", "iam:DeleteRolePolicy"],
      "Resource": ["arn:*:iam::*:role/*-iam-service-role", "arn:*:iam::*:role/ng-role_*"],
      "Effect": "Allow"
    },
    {
      "Action": ["iam:GetPolicy"],
      "Resource": ["arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"],
      "Effect": "Allow"
    },
    {
      "Action": [
        "eks:DescribeCluster",
        "eks:ListClusters",
        "eks:CreateCluster",
        "eks:TagResource",
        "eks:UpdateClusterVersion",
        "eks:DeleteCluster",
        "eks:UpdateClusterConfig",
        "eks:UntagResource",
        "eks:UpdateNodegroupVersion",
        "eks:DescribeNodegroup",
        "eks:DeleteNodegroup",
        "eks:UpdateNodegroupConfig",
        "eks:CreateNodegroup",
        "eks:AssociateEncryptionConfig",
        "eks:ListIdentityProviderConfigs",
        "eks:AssociateIdentityProviderConfig",
        "eks:DescribeIdentityProviderConfig",
        "eks:DisassociateIdentityProviderConfig"
      ],
      "Resource": ["arn:*:eks:*:*:cluster/*", "arn:*:eks:*:*:nodegroup/*/*/*"],
      "Effect": "Allow"
    },
    {
      "Action": [
        "ec2:AssociateVpcCidrBlock",
        "ec2:DisassociateVpcCidrBlock",
        "eks:ListAddons",
        "eks:CreateAddon",
        "eks:DescribeAddonVersions",
        "eks:DescribeAddon",
        "eks:DeleteAddon",
        "eks:UpdateAddon",
        "eks:TagResource",
        "eks:DescribeFargateProfile",
        "eks:CreateFargateProfile",
        "eks:DeleteFargateProfile"
      ],
      "Resource": ["*"],
      "Effect": "Allow"
    },
    {
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "eks.amazonaws.com"
        }
      },
      "Action": ["iam:PassRole"],
      "Resource": ["*"],
      "Effect": "Allow"
    },
    {
      "Condition": {
        "ForAnyValue:StringLike": {
          "kms:ResourceAliases": "alias/cluster-api-provider-aws-*"
        }
      },
      "Action": ["kms:CreateGrant", "kms:DescribeKey"],
      "Resource": ["*"],
      "Effect": "Allow"
    }
  ]
}

Global Role Additional Policies

There may be situations where additional node-level policies must be added to your deployment.

This is not required when using Minimum Permissions Policies.

The Add IAM policies option requires the iam:ListPolicies and iam:GetPolicy permissions. The PaletteDeploymentPolicy in the Core IAM Policies includes both. If you use the Minimum Permissions Policies and want to attach additional policies, add iam:ListPolicies to the IAM User or Role that Palette uses. Also make sure that it has iam:GetPolicy on each policy that you attach.

Use the following steps to add node-level policies.

1. Log in to Palette.
2. Switch to the Tenant Admin project, and select Tenant Settings from the left main menu.
3. Select Cloud Accounts.
4. Add an AWS account if one does not exist.
5. After validation of the AWS credentials, ensure Add IAM policies is enabled. You can specify additional Amazon Resource Names (ARNs) to be attached. The attached policies will be included to all the clusters launched with this specific AWS cloud Account.

Host Resource Groups Policy

If you plan to deploy AWS IaaS clusters on Amazon Elastic Compute Cloud (EC2) Dedicated Hosts, you must attach the PaletteHostResourceGroupsPolicy on top of the Core IAM Policies or Minimum Permissions Policies.

Last Update: January 17, 2026

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PaletteHostResourceGroupsPermissions",
      "Effect": "Allow",
      "Action": [
        "resource-groups:ListGroups",
        "resource-groups:GetGroupConfiguration",
        "resource-groups:ListGroupResources",
        "license-manager:GetLicenseConfiguration",
        "ec2:DescribeHosts"
      ],
      "Resource": "*"
    }
  ]
}

EKS Pod Identity with Minimum Permissions Policies

info

These permissions have been included in the prerequisites steps for enabling EKS Pod Identity in the Add AWS Accounts guide and are mentioned here for posterity and reference.

If you are using Minimum Permissions Policies for EKS (static or dynamic) and you want to enable EKS Pod Identity, the following permissions policy must also be assigned to the IAM role or IAM target role created for Palette (for example, SpectroCloudPaletteRole or SpectroCloudPaletteTargetRole).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "eks:DescribeAddonVersions",
        "eks:CreateAddon",
        "eks:UpdateAddon"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["iam:PassRole"],
      "Resource": "*"
    }
  ]
}