After deploying a stack, if someone tries to access AWS EKS using kubectl, (s)he will get the following authorization error:
"error: You must be logged in to the server (Unauthorized)."
This happens when the Amazon EKS cluster is created by an IAM user or role that's different from the one used by aws-iam-authenticator.
For example, this happens when user A deploys a stack, and user B downloads kubeconfig of the deployed stack and tries to access the EKS using kubectl.
Initially, only the creator of the Amazon EKS cluster has system:masters permissions to configure the cluster. To extend system:masters permissions to other users and roles, you must add the aws-auth ConfigMap to the configuration of the Amazon EKS cluster. The ConfigMap allows other IAM entities, such as users and roles, to access the Amazon EKS cluster.
To resolve this issue, you need to add other IAM users to the EKS cluster as described in the AWS document.
Follow the section of the AWS document:
If the AWS component of the stack is configured with IAM Access Keys, follow the section of Add designated_user to the ConfigMap if cluster_creator is an IAM user.
If the AWS component of the stack is configured with IAM Role, follow the section of Add designated_user to the ConfigMap if the cluster_creator is an IAM role.
Note: To allow other IAM users to assume the role of cluster_creator using "aws sts assume-role," the assumed role permission must be granted to the IAM users first. See the detail here for granting an IAM user to assume a role.