Minimum IAM Permissions Required to Import an EKS Cluster into Rancher

• Rancher 2.x
• EKS cluster(s) provisioned and managed outside of Rancher

There is official documentation (Minimum EKS Permissions) outlining the minimum IAM permissions required to manage EKS clusters through Rancher. These permissions cover the full lifecycle of EKS cluster management, including creation, modification, and deletion of clusters.

However, in certain scenarios—particularly when restricted by internal security or compliance policies—organizations may prefer to grant IAM permissions that allow only the import of existing EKS clusters into Rancher.

For such use cases, you can refer to the reduced permission set provided in this Knowledge Base (KB) article, which is tailored specifically for the EKS import process only.

The IAM permissions listed are the bare minimum required, removing any of the permissions will cause permission failures for your import process.

Note: These permissions are specifically designed to support the import process only and do not grant Rancher the ability to make configuration changes to the EKS cluster via the AWS API. If you plan to perform any actions beyond importing—such as scaling node groups, EKS upgrades, and modifying the cluster configuration—you will need to update your cloud credentials to include additional IAM permissions appropriate for those operations.

For a full list of permissions required to manage EKS clusters through Rancher, please refer to the official documentation on Minimum EKS Permissions

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "EKSPermissions",
			"Effect": "Allow",
			"Action": [
				"eks:DescribeAddon",
				"eks:DescribeCluster",
				"eks:DescribeFargateProfile",
				"eks:DescribeNodegroup",
				"eks:DescribeUpdate",
				"eks:ListClusters",
				"eks:ListFargateProfiles",
				"eks:ListNodegroups",
				"eks:ListTagsForResource",
				"eks:ListUpdates",
				"eks:TagResource",
				"eks:UntagResource",
				"eks:UpdateClusterConfig",
				"eks:UpdateClusterVersion",
				"eks:UpdateNodegroupConfig",
				"eks:UpdateNodegroupVersion"
			],
			"Resource": "*"
		}
	]
}