According to documentation of both kops and aws, the dedicated kops user needs IAMFullAccess permission to operate properly.

Why is this permission needed?

Is there a way to avoid (i.e. restrict) this, given that it is a bit too intrusive to create a user with such a permission?

edit: one could assume that the specific permission is needed to attach the respective roles to the master(s) and node(s) instances;

therefore perhaps the question / challenge becomes how to:

• not use IAMFullAccess
• sync with the node creation / bootstrapping process and attach the above roles; (perhaps create a cluster on pre-configured instances? - no idea if kops provides for that)