AWS EKS: User cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope

Terraform Providers AWS
1

Hi, I cannot get by this error, it prevents me from creating a Cluster Role Binding while I try to provision a new EKS cluster and associated resources. Here are details of my workflow:

  1. Two AWS accounts, DEV and STAGING
  2. Within the STAGING account, I have an IAM role Anonymous, which can assume Admin roles in both accounts; this this IAM role should have full access to everything
  3. I am trying to create the new EKS cluster and its resources in the DEV account
  4. I am using the Atlantis tool. Atlantis uses the IAM role Anonymous to run Plan and Apply

Essentially, I get an error saying the Service Account Anonymous does not have the proper permissions to create the clusterrolebindings resource. I’m not sure why; am I confusing the Anonymous SA and the Anonymous IAM role?

Here is the error:

│ Error: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:default:Anonymous" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope
│ 
│   with module.eks-cluster.kubernetes_cluster_role_binding.cluster_rb,
│   on file.tf line xxx, in resource "kubernetes_cluster_role_binding" "cluster-role-binding":
│  xxx: resource "kubernetes_cluster_role_binding" "cluster-role-binding" {

Here is my Terraform. This is to create a read-only role that others can access (the view-only cluster role does exist):

resource "kubernetes_cluster_role_binding" "cluster_read-only" {
  metadata {
    name      = "cluster-role-binding"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "view-only"
  }

  subject {
    kind      = "Group"
    name      = "read-only"
    api_group = "rbac.authorization.k8s.io"
  }
}

I try to assign the proper permissions to the Anonymous SA with the code shown below but it doesn’t work. If anyone has suggestions, please let me know.

resource "kubernetes_cluster_role_binding" "cluster_admin_access" {
  metadata {
    name      = "cluster-role-binding-admin"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "cluster-admin"
  }

 subject {
   kind      = "ServiceAccount"
   name      = "Anonymous"
   namespace = "default"
 }
  subject {
    kind      = "Group"
    name      = "system:masters"
    api_group = "rbac.authorization.k8s.io"
  }
}