Skip to main content

Minimum Permissions Policies

The following policies are designed from the principle of least privilege. You can use these policies to narrow the permissions Palette requires to operate instead of using the Core IAM Policies.

Step 1: Add Minimum Permissions Policies to IAM User or Role​

Create an IAM User or Role with at least one of the policies listed based on your use case.

The following policy allows Palette to operate and create Virtual Private Cloud (VPC) resources as needed while retaining minimal permissions for deploying Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) clusters through Palette.

Last Update: November 3, 2026

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ASGDescribe",
            "Effect": "Allow",
            "Action": "autoscaling:DescribeAutoScalingGroups",
            "Resource": "*"
        },
        {
            "Sid": "EC2Permissions",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DeleteSubnet",
                "ec2:DescribeAddresses",
                "ec2:DescribeInstances",
                "ec2:CreateNatGateway",
                "ec2:DescribeRegions",
                "ec2:CreateVpc",
                "ec2:AttachInternetGateway",
                "ec2:DescribeVpcAttribute",
                "ec2:DeleteRouteTable",
                "ec2:ModifySubnetAttribute",
                "ec2:AssociateRouteTable",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeAvailabilityZones",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:CreateSecurityGroup",
                "ec2:ModifyVpcAttribute",
                "ec2:DeleteInternetGateway",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeRouteTables",
                "ec2:ReleaseAddress",
                "ec2:CreateTags",
                "ec2:DeleteNetworkInterface",
                "ec2:CreateRouteTable",
                "ec2:DetachInternetGateway",
                "ec2:DescribeNatGateways",
                "ec2:DisassociateRouteTable",
                "ec2:AllocateAddress",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteNatGateway",
                "ec2:DescribeVpcEndpoints",
                "ec2:DeleteVpc",
                "ec2:CreateSubnet",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EKSPermissions",
            "Effect": "Allow",
            "Action": [
                "eks:DeleteCluster",
                "eks:DescribeNodegroup",
                "eks:DeleteNodegroup",
                "eks:TagResource",
                "eks:ListAddons",
                "eks:DescribeCluster",
                "eks:CreateNodegroup",
                "eks:CreateCluster"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IAMListOpenIDConnectProviders",
            "Effect": "Allow",
            "Action": "iam:ListOpenIDConnectProviders",
            "Resource": "*"
        },
        {
            "Sid": "IAMOpenIDConnectProviderPermissions",
            "Effect": "Allow",
            "Action": [
                "iam:DeleteOpenIDConnectProvider",
                "iam:GetOpenIDConnectProvider",
                "iam:TagOpenIDConnectProvider",
                "iam:CreateOpenIDConnectProvider"
            ],
            "Resource": [
                "arn:aws:iam::*:oidc-provider/*"
            ]
        },
        {
            "Sid": "IAMRolePermissions",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole",
                "iam:ListAttachedRolePolicies"
            ],
            "Resource": [
                "arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
            ]
        },
        {
            "Sid": "IAMClusterRoles",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:TagRole",
                "iam:PassRole",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:PutRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:ListRolePolicies"
            ],
            "Resource": [
                "arn:*:iam::*:role/*-iam-service-role",
                "arn:*:iam::*:role/ng-role_*"
            ]
        },
        {
            "Sid": "IAMAWSManagedPolicyRead",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicy"
            ],
            "Resource": [
                "arn:*:iam::aws:policy/*"
            ]
        },
        {
            "Sid": "EKSServiceLinkedRoles",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS",
                "arn:*:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
            ]
        },
        {
            "Sid": "EKSOptimizedAMILookup",
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": [
                "arn:*:ssm:*:*:parameter/aws/service/eks/optimized-ami/*"
            ]
        },
        {
            "Sid": "EKSServiceLinkedRoleRead",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS",
                "arn:*:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup",
                "arn:*:iam::*:role/aws-service-role/eks-fargate-pods.amazonaws.com/AWSServiceRoleForAmazonEKSForFargate"
            ]
        },
        {
            "Sid": "ASGManagement",
            "Effect": "Allow",
            "Action": [
                "autoscaling:CreateOrUpdateTags",
                "autoscaling:DeleteTags",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:StartInstanceRefresh",
                "autoscaling:CancelInstanceRefresh"
            ],
            "Resource": [
                "arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*"
            ]
        },
        {
            "Sid": "ASGDescribeMore",
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeInstanceRefreshes",
                "autoscaling:DescribeTags"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
warning

  • These permissions specified do not include all the permissions required for all possible use cases and for taking full advantage of all Palette features. Additional permissions may be required based on the specific use case. Review the Additional IAM Policies for Specific Use Cases section for more information.

  • These IAM policies cannot be used as inline policies because they exceed AWS's 2048 non-whitespace-character limit. We recommend breaking the policy into multiple inline policies or creating new managed policies.

  • The following IAM warning is expected and can be ignored.

    These policies define some actions, resources, or conditions that do not provide permissions. To grant access, policies must have an action that has an applicable resource or condition.

Step 2: Choose CloudFormation Stack Management Option​

Once you have created the IAM User or Role, there are two options for using minimum permissions policies:

info

If you want to use option 2 for deploying AWS Infrastructure as a Service (IaaS) clusters, you must use the Palette eXtended Kubernetes (PXK) pack for the Kubernetes layer of your cluster profiles.

Only the PXK pack supports the manageCloudFormationStackManually property required to reference a manually created CloudFormation stack.

Option 1: Automatic CloudFormation Stack Management​

Assign the following additional permissions policy on top of the minimum permissions policies to your IAM User or Role. These permissions allow Palette to manage the creation and lifecycle of the CloudFormation stack used for provisioning the required Cluster API Provider AWS (CAPA) roles automatically.

Keep iam:TagRole and iam:UntagRole in this policy, even if a policy audit reports them as unused. AWS CloudFormation, not Palette, uses these actions to tag the IAM roles in the CloudFormation stack that Palette uses, and stack updates fail without them.

Last Update: November 3, 2026

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudFormationStackPermissions",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStackResources",
                "cloudformation:ListStackResources",
                "cloudformation:GetTemplate",
                "cloudformation:ContinueUpdateRollback",
                "cloudformation:DeleteStack"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IAMCAPARolePermissions",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:TagRole",
                "iam:UntagRole",
                "iam:UpdateAssumeRolePolicy",
                "iam:GetPolicyVersion",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:GetPolicy",
                "iam:ListPolicyVersions",
                "iam:GetRole",
                "iam:GetInstanceProfile",
                "iam:DetachRolePolicy",
                "iam:CreatePolicy",
                "iam:TagPolicy",
                "iam:CreateInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:TagInstanceProfile",
                "iam:DeletePolicy",
                "iam:DeleteRole",
                "iam:DeleteInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile"
            ],
            "Resource": "*"
        }
    ]
}

Option 2: Manual CloudFormation Stack Management​

After adding the minimum permissions policies to your IAM User or Role, you must complete the additional steps outlined in the following sections:

  1. Create CloudFormation Stacks for Palette.

  2. Configure Cluster Profiles for Manual CloudFormation Stack Management.

Create CloudFormation Stacks for Palette​

When using the minimum permissions policies, you must manually create the CloudFormation stack that Palette uses to create the required Cluster API Provider AWS (CAPA) roles.

  1. Create a file named palette-cloudformation-input-template.yaml and copy the contents of the following CloudFormation template. This template is used for creating the required CAPA roles.

    Last Update: February 14, 2026

    AWSTemplateFormatVersion: 2010-09-09
    Resources:
      AWSIAMInstanceProfileControlPlane:
        Properties:
          InstanceProfileName: control-plane.cluster-api-provider-aws.sigs.k8s.io
          Roles:
          - Ref: AWSIAMRoleControlPlane
        Type: AWS::IAM::InstanceProfile
      AWSIAMInstanceProfileControllers:
        Properties:
          InstanceProfileName: controllers.cluster-api-provider-aws.sigs.k8s.io
          Roles:
          - Ref: AWSIAMRoleControllers
        Type: AWS::IAM::InstanceProfile
      AWSIAMInstanceProfileNodes:
        Properties:
          InstanceProfileName: nodes.cluster-api-provider-aws.sigs.k8s.io
          Roles:
          - Ref: AWSIAMRoleNodes
        Type: AWS::IAM::InstanceProfile
      AWSIAMManagedPolicyCloudProviderControlPlane:
        Properties:
          Description: For the Kubernetes Cloud Provider AWS Control Plane
          ManagedPolicyName: control-plane.cluster-api-provider-aws.sigs.k8s.io
          PolicyDocument:
            Statement:
            - Action:
              - autoscaling:DescribeAutoScalingGroups
              - autoscaling:DescribeLaunchConfigurations
              - autoscaling:DescribeTags
              - ec2:AssignIpv6Addresses
              - ec2:DescribeInstances
              - ec2:DescribeImages
              - ec2:DescribeRegions
              - ec2:DescribeRouteTables
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSubnets
              - ec2:DescribeVolumes
              - ec2:CreateSecurityGroup
              - ec2:CreateTags
              - ec2:CreateVolume
              - ec2:ModifyInstanceAttribute
              - ec2:ModifyVolume
              - ec2:AttachVolume
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:CreateRoute
              - ec2:DeleteRoute
              - ec2:DeleteSecurityGroup
              - ec2:DeleteVolume
              - ec2:DetachVolume
              - ec2:RevokeSecurityGroupIngress
              - ec2:DescribeVpcs
              - elasticloadbalancing:AddTags
              - elasticloadbalancing:AttachLoadBalancerToSubnets
              - elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
              - elasticloadbalancing:CreateLoadBalancer
              - elasticloadbalancing:CreateLoadBalancerPolicy
              - elasticloadbalancing:CreateLoadBalancerListeners
              - elasticloadbalancing:ConfigureHealthCheck
              - elasticloadbalancing:DeleteLoadBalancer
              - elasticloadbalancing:DeleteLoadBalancerListeners
              - elasticloadbalancing:DescribeLoadBalancers
              - elasticloadbalancing:DescribeLoadBalancerAttributes
              - elasticloadbalancing:DetachLoadBalancerFromSubnets
              - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
              - elasticloadbalancing:ModifyLoadBalancerAttributes
              - elasticloadbalancing:RegisterInstancesWithLoadBalancer
              - elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer
              - elasticloadbalancing:CreateListener
              - elasticloadbalancing:CreateTargetGroup
              - elasticloadbalancing:DeleteListener
              - elasticloadbalancing:DeleteTargetGroup
              - elasticloadbalancing:DeregisterTargets
              - elasticloadbalancing:DescribeListeners
              - elasticloadbalancing:DescribeLoadBalancerPolicies
              - elasticloadbalancing:DescribeTargetGroups
              - elasticloadbalancing:DescribeTargetHealth
              - elasticloadbalancing:ModifyListener
              - elasticloadbalancing:ModifyTargetGroup
              - elasticloadbalancing:RegisterTargets
              - elasticloadbalancing:SetLoadBalancerPoliciesOfListener
              - iam:CreateServiceLinkedRole
              - kms:DescribeKey
              Effect: Allow
              Resource:
              - '*'
            Version: 2012-10-17
          Roles:
          - Ref: AWSIAMRoleControlPlane
        Type: AWS::IAM::ManagedPolicy
      AWSIAMManagedPolicyCloudProviderNodes:
        Properties:
          Description: For the Kubernetes Cloud Provider AWS nodes
          ManagedPolicyName: nodes.cluster-api-provider-aws.sigs.k8s.io
          PolicyDocument:
            Statement:
            - Action:
              - ec2:AssignIpv6Addresses
              - ec2:DescribeInstances
              - ec2:DescribeRegions
              - ec2:CreateTags
              - ec2:DescribeTags
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeInstanceTypes
              - ecr:GetAuthorizationToken
              - ecr:BatchCheckLayerAvailability
              - ecr:GetDownloadUrlForLayer
              - ecr:GetRepositoryPolicy
              - ecr:DescribeRepositories
              - ecr:ListImages
              - ecr:BatchGetImage
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - secretsmanager:DeleteSecret
              - secretsmanager:GetSecretValue
              Effect: Allow
              Resource:
              - arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*
            - Action:
              - ssm:UpdateInstanceInformation
              - ssmmessages:CreateControlChannel
              - ssmmessages:CreateDataChannel
              - ssmmessages:OpenControlChannel
              - ssmmessages:OpenDataChannel
              - s3:GetEncryptionConfiguration
              Effect: Allow
              Resource:
              - '*'
            Version: 2012-10-17
          Roles:
          - Ref: AWSIAMRoleControlPlane
          - Ref: AWSIAMRoleNodes
        Type: AWS::IAM::ManagedPolicy
      AWSIAMManagedPolicyControllers:
        Properties:
          Description: For the Kubernetes Cluster API Provider AWS Controllers
          ManagedPolicyName: controllers.cluster-api-provider-aws.sigs.k8s.io
          PolicyDocument:
            Statement:
            - Action:
              - ec2:AttachNetworkInterface
              - ec2:DetachNetworkInterface
              - ec2:AllocateAddress
              - ec2:AssignIpv6Addresses
              - ec2:AssignPrivateIpAddresses
              - ec2:UnassignPrivateIpAddresses
              - ec2:AssociateRouteTable
              - ec2:AttachInternetGateway
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:CreateInternetGateway
              - ec2:CreateEgressOnlyInternetGateway
              - ec2:CreateNatGateway
              - ec2:CreateNetworkInterface
              - ec2:CreateRoute
              - ec2:CreateRouteTable
              - ec2:CreateSecurityGroup
              - ec2:CreateSubnet
              - ec2:CreateTags
              - ec2:CreateVpc
              - ec2:ModifyVpcAttribute
              - ec2:DeleteInternetGateway
              - ec2:DeleteEgressOnlyInternetGateway
              - ec2:DeleteNatGateway
              - ec2:DeleteRouteTable
              - ec2:ReplaceRoute
              - ec2:DeleteSecurityGroup
              - ec2:DeleteSubnet
              - ec2:DeleteTags
              - ec2:DeleteVpc
              - ec2:DescribeAccountAttributes
              - ec2:DescribeAddresses
              - ec2:DescribeAvailabilityZones
              - ec2:DescribeInstances
              - ec2:DescribeInstanceTypes
              - ec2:DescribeInternetGateways
              - ec2:DescribeEgressOnlyInternetGateways
              - ec2:DescribeInstanceTypes
              - ec2:DescribeImages
              - ec2:DescribeNatGateways
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeNetworkInterfaceAttribute
              - ec2:DescribeRouteTables
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSubnets
              - ec2:DescribeVpcs
              - ec2:DescribeVpcAttribute
              - ec2:DescribeVolumes
              - ec2:DescribeTags
              - ec2:DetachInternetGateway
              - ec2:DisassociateRouteTable
              - ec2:DisassociateAddress
              - ec2:ModifyInstanceAttribute
              - ec2:ModifyNetworkInterfaceAttribute
              - ec2:ModifySubnetAttribute
              - ec2:ReleaseAddress
              - ec2:RevokeSecurityGroupIngress
              - ec2:RunInstances
              - ec2:TerminateInstances
              - tag:GetResources
              - elasticloadbalancing:AddTags
              - elasticloadbalancing:CreateLoadBalancer
              - elasticloadbalancing:ConfigureHealthCheck
              - elasticloadbalancing:DeleteLoadBalancer
              - elasticloadbalancing:DeleteTargetGroup
              - elasticloadbalancing:DescribeLoadBalancers
              - elasticloadbalancing:DescribeLoadBalancerAttributes
              - elasticloadbalancing:DescribeTargetGroups
              - elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
              - elasticloadbalancing:DescribeTags
              - elasticloadbalancing:ModifyLoadBalancerAttributes
              - elasticloadbalancing:RegisterInstancesWithLoadBalancer
              - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
              - elasticloadbalancing:RemoveTags
              - autoscaling:DescribeAutoScalingGroups
              - autoscaling:DescribeInstanceRefreshes
              - ec2:CreateLaunchTemplate
              - ec2:CreateLaunchTemplateVersion
              - ec2:DescribeLaunchTemplates
              - ec2:DescribeLaunchTemplateVersions
              - ec2:DeleteLaunchTemplate
              - ec2:DeleteLaunchTemplateVersions
              - ec2:DescribeKeyPairs
              - ec2:ModifyInstanceMetadataOptions
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - autoscaling:CreateAutoScalingGroup
              - autoscaling:UpdateAutoScalingGroup
              - autoscaling:CreateOrUpdateTags
              - autoscaling:StartInstanceRefresh
              - autoscaling:DeleteAutoScalingGroup
              - autoscaling:DeleteTags
              Effect: Allow
              Resource:
              - arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: autoscaling.amazonaws.com
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: elasticloadbalancing.amazonaws.com
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: spot.amazonaws.com
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot
            - Action:
              - iam:PassRole
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io
            - Action:
              - secretsmanager:CreateSecret
              - secretsmanager:DeleteSecret
              - secretsmanager:TagResource
              Effect: Allow
              Resource:
              - arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*
            Version: 2012-10-17
          Roles:
          - Ref: AWSIAMRoleControllers
          - Ref: AWSIAMRoleControlPlane
        Type: AWS::IAM::ManagedPolicy
      AWSIAMManagedPolicyControllersEKS:
        Properties:
          Description: For the Kubernetes Cluster API Provider AWS Controllers
          ManagedPolicyName: controllers-eks.cluster-api-provider-aws.sigs.k8s.io
          PolicyDocument:
            Statement:
            - Action:
              - ssm:GetParameter
              Effect: Allow
              Resource:
              - arn:*:ssm:*:*:parameter/aws/service/eks/optimized-ami/*
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: eks.amazonaws.com
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: eks-nodegroup.amazonaws.com
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup
            - Action:
              - iam:CreateServiceLinkedRole
              Condition:
                StringLike:
                  iam:AWSServiceName: eks-fargate.amazonaws.com
              Effect: Allow
              Resource:
              - arn:aws:iam::*:role/aws-service-role/eks-fargate-pods.amazonaws.com/AWSServiceRoleForAmazonEKSForFargate
            - Action:
              - iam:ListOpenIDConnectProviders
              - iam:GetOpenIDConnectProvider
              - iam:CreateOpenIDConnectProvider
              - iam:AddClientIDToOpenIDConnectProvider
              - iam:UpdateOpenIDConnectProviderThumbprint
              - iam:DeleteOpenIDConnectProvider
              - iam:TagOpenIDConnectProvider
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - iam:GetRole
              - iam:ListAttachedRolePolicies
              Effect: Allow
              Resource:
              - arn:*:iam::*:role/*
            - Action:
              - iam:GetPolicy
              Effect: Allow
              Resource:
              - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
            - Action:
              - eks:DescribeCluster
              - eks:ListClusters
              - eks:CreateCluster
              - eks:TagResource
              - eks:UpdateClusterVersion
              - eks:DeleteCluster
              - eks:UpdateClusterConfig
              - eks:UntagResource
              - eks:UpdateNodegroupVersion
              - eks:DescribeNodegroup
              - eks:DeleteNodegroup
              - eks:UpdateNodegroupConfig
              - eks:CreateNodegroup
              - eks:AssociateEncryptionConfig
              - eks:ListIdentityProviderConfigs
              - eks:AssociateIdentityProviderConfig
              - eks:DescribeIdentityProviderConfig
              - eks:DisassociateIdentityProviderConfig
              Effect: Allow
              Resource:
              - arn:*:eks:*:*:cluster/*
              - arn:*:eks:*:*:nodegroup/*/*/*
            - Action:
              - ec2:AssociateVpcCidrBlock
              - ec2:DisassociateVpcCidrBlock
              - eks:ListAddons
              - eks:CreateAddon
              - eks:DescribeAddonVersions
              - eks:DescribeAddon
              - eks:DeleteAddon
              - eks:UpdateAddon
              - eks:TagResource
              - eks:DescribeFargateProfile
              - eks:CreateFargateProfile
              - eks:DeleteFargateProfile
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - iam:PassRole
              Condition:
                StringEquals:
                  iam:PassedToService: eks.amazonaws.com
              Effect: Allow
              Resource:
              - '*'
            - Action:
              - kms:CreateGrant
              - kms:DescribeKey
              Condition:
                ForAnyValue:StringLike:
                  kms:ResourceAliases: alias/cluster-api-provider-aws-*
              Effect: Allow
              Resource:
              - '*'
            Version: 2012-10-17
          Roles:
          - Ref: AWSIAMRoleControllers
          - Ref: AWSIAMRoleControlPlane
        Type: AWS::IAM::ManagedPolicy
      AWSIAMRoleControlPlane:
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Action:
              - sts:AssumeRole
              Effect: Allow
              Principal:
                Service:
                - ec2.amazonaws.com
            Version: 2012-10-17
          RoleName: control-plane.cluster-api-provider-aws.sigs.k8s.io
        Type: AWS::IAM::Role
      AWSIAMRoleControllers:
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Action:
              - sts:AssumeRole
              Effect: Allow
              Principal:
                Service:
                - ec2.amazonaws.com
            Version: 2012-10-17
          RoleName: controllers.cluster-api-provider-aws.sigs.k8s.io
        Type: AWS::IAM::Role
      AWSIAMRoleEKSControlPlane:
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Action:
              - sts:AssumeRole
              Effect: Allow
              Principal:
                Service:
                - eks.amazonaws.com
            Version: 2012-10-17
          ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
          RoleName: eks-controlplane.cluster-api-provider-aws.sigs.k8s.io
        Type: AWS::IAM::Role
      AWSIAMRoleNodes:
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Action:
              - sts:AssumeRole
              Effect: Allow
              Principal:
                Service:
                - ec2.amazonaws.com
            Version: 2012-10-17
          ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
          - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
          RoleName: nodes.cluster-api-provider-aws.sigs.k8s.io
        Type: AWS::IAM::Role

  2. Once the file is created, use the following steps in the AWS Console or AWS CLI to create the CloudFormation stack.

    1. Log in to the AWS Management Console and navigate to the CloudFormation service.

    2. Create a new stack by clicking on the Create stack button and selecting With new resources (standard).

    3. Leave the Choose an existing template option selected, and under the Specify template section, select Upload a template file. Click Choose file and select the palette-cloudformation-input-template.yaml file you created earlier. Click Next.

    4. Provide the Stack name as cluster-api-provider-aws-sigs-k8s-io and click Next.

    5. On the Configure stack options page, check the box for I acknowledge that AWS CloudFormation might create IAM resources with customized names.

      Configure any additional options as needed and click Next.

    6. Review the stack configuration and click Submit to create the CloudFormation stack.

    7. Wait for the stack creation to complete. You can monitor the progress in the CloudFormation console.

Configure Cluster Profiles for Manual CloudFormation Stack Management​

After creating the CloudFormation stack, you must configure the Kubernetes layer of your cluster profiles to use the manually created stack. This ensures that Palette uses the existing stack rather than attempting to create and manage one automatically.

info

Only the Palette eXtended Kubernetes (PXK) pack supports the manageCloudFormationStackManually configuration.

  1. Log in to Palette.

  2. From the left main menu, select Profiles.

  3. Choose an existing cluster profile or create a new cluster profile.

  4. Once in the cluster profile overview with all the layers listed, select the Kubernetes layer to view the Edit Pack page.

  5. In the YAML editor, add the manageCloudFormationStackManually.enabled field and set the value to true as shown below.

    pack:
    ---
    kubeadmconfig:
    ---
    manageCloudFormationStackManually:
      enabled: true

  6. Confirm Updates to save the changes to the Kubernetes layer.

  7. Save Changes to the cluster profile.