eks:UntagResource

Tagging

eks:UntagResource is a Tagging access-level action in the eks service. Grants permission to untag the specified resource

Resource types

ARNs that eks:UntagResource can be scoped to in an IAM policy.

arn:${Partition}:eks:${Region}:${Account}:access-entry/${ClusterName}/${IamIdentityType}/${IamIdentityAccountID}/${IamIdentityName}/${UUID}

access-entry

arn:${Partition}:eks:${Region}:${Account}:addon/${ClusterName}/${AddonName}/${UUID}

addon

arn:${Partition}:eks:${Region}:${Account}:capability/${ClusterName}/${CapabilityType}/${CapabilityName}/${UUID}

capability

arn:${Partition}:eks:${Region}:${Account}:cluster/${ClusterName}

cluster

arn:${Partition}:eks:${Region}:${Account}:dashboard/${DashboardName}

dashboard

arn:${Partition}:eks:${Region}:${Account}:eks-anywhere-subscription/${UUID}

eks-anywhere-subscription

arn:${Partition}:eks:${Region}:${Account}:fargateprofile/${ClusterName}/${FargateProfileName}/${UUID}

fargateprofile

arn:${Partition}:eks:${Region}:${Account}:identityproviderconfig/${ClusterName}/${IdentityProviderType}/${IdentityProviderConfigName}/${UUID}

identityproviderconfig

arn:${Partition}:eks:${Region}:${Account}:nodegroup/${ClusterName}/${NodegroupName}/${UUID}

nodegroup

arn:${Partition}:eks:${Region}:${Account}:podidentityassociation/${ClusterName}/${UUID}

podidentityassociation

Condition keys

Keys you can use in the Condition block of a policy that grants eks:UntagResource.

aws:ResourceTag/${TagKey} String

Filters access by a tag key and value pair

eks:accessEntryType String

Filters access by the access entry type present in the access entry requests the user makes to the EKS service

eks:clusterName String

Filters access by the clusterName present in the access entry requests the user makes to the EKS service

eks:kubernetesGroups ArrayOfString

Filters access by the kubernetesGroups present in the access entry requests the user makes to the EKS service

eks:principalArn ARN

Filters access by the principalArn present in the access entry requests requests the user makes to the EKS service

eks:username String

Filters access by the Kubernetes username present in the access entry requests the user makes to the EKS service

Example IAM policy

A minimal policy that allows eks:UntagResource. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEksUntagResource",
      "Effect": "Allow",
      "Action": "eks:UntagResource",
      "Resource": "*"
    }
  ]
}

Related actions in eks

eks:AccessKubernetesApi Read eks:AssociateAccessPolicy Write eks:AssociateEncryptionConfig Write eks:AssociateIdentityProviderConfig Write eks:CancelUpdate Write eks:CreateAccessEntry Write eks:CreateAddon Write eks:CreateCapability Write eks:CreateCluster Write eks:CreateEksAnywhereSubscription Write eks:CreateFargateProfile Write eks:CreateNodegroup Write

View all eks actions →