aws eksConnect kubectl to EKS and manage cluster access
aws eks manages Amazon EKS clusters: describe them, scale node groups, and above all write your kubeconfig with update-kubeconfig and control who may log in with access entries. Every kubectl call to EKS then authenticates with a short-lived token minted from your AWS identity.
aws eks list-clusters | describe-cluster --name N | update-kubeconfig --name N [--alias A] | get-token | create-access-entry | ...You've been asked to look at the production EKS cluster and have never connected to it from this machine.
aws eksThe EKS control-plane API: clusters, node groups, add-ons, access entries.
update-kubeconfig calls DescribeCluster to get the API server endpoint and CA certificate, and writes a cluster, a context and a user to ~/.kube/config. The user has no password or certificate: it's an exec plugin that runs aws eks get-token. On every kubectl request, get-token builds a presigned STS GetCallerIdentity URL with your current AWS credentials, base64-encodes it as k8s-aws-v1.<...> and hands it to kubectl as a bearer token valid for about 15 minutes. The EKS API server's authenticator calls STS with that URL, learns your IAM ARN, then maps it to a Kubernetes identity: through access entries (the EKS API) and their access policies, or the older aws-auth ConfigMap. Kubernetes RBAC then decides what you may do. So 'Unauthorized' means the IAM identity isn't mapped; 'Forbidden' means it is mapped but RBAC says no.
kubectl gets a presigned STS URL from the AWS CLI; EKS uses it to learn your IAM identity and maps it to Kubernetes RBAC.
The kubeconfig user is an exec plugin. kubectl runs aws eks get-token, which uses your current AWS credentials (profile, env vars or role).
list-clustersCluster names in the regiondescribe-cluster --name NStatus, version, endpoint, auth mode, networkingupdate-kubeconfig --name NWrite kubeconfig entries; --alias, --role-arn, --profileget-token --cluster-name NPrint the ExecCredential kubectl uses (for debugging)create-access-entryLet an IAM principal into the cluster; then associate-access-policylist-access-entriesWhich IAM principals have accessupdate-nodegroup-configScale managed node groups (list-nodegroups to find them)describe-update --update-idTrack an asynchronous change (version upgrade, scaling)Running update-kubeconfig with one profile and kubectl with anotherget-token uses whatever credentials are active at kubectl time, so you authenticate as a different identity and get Unauthorized.
update-kubeconfig --profile prod (it's written into the kubeconfig), or keep AWS_PROFILE consistentEditing the aws-auth ConfigMap by hand to add usersA YAML mistake there can lock everyone, including nodes, out of the cluster.
Access entries via aws eks create-access-entry, and authentication mode APIAssuming the cluster creator will always have accessThat implicit admin is tied to one IAM identity; if it's a person's role that gets deleted, nobody can get in.
Explicit access entries for an admin role, managed in TerraformTry these on a Linux machine of your own. Each task has a hint and a solution.
Learn the token format: base64-decode the start of an EKS token, 'aHR0cHM6Ly9zdHMudXMtZWFzdC0xLmFtYXpvbmF3cy5jb20v', and see what it points to.
Add the staging-eks cluster in eu-west-1 to your kubeconfig with the context name staging, then list its namespaces with kubectl.
Give the IAM role dev-team read-only access to the namespace shop only, on prod-eks.
aws eksConnect kubectl to EKS and manage cluster access
aws eks manages Amazon EKS clusters: describe them, scale node groups, and above all write your kubeconfig with update-kubeconfig and control who may log in with access entries. Every kubectl call to EKS then authenticates with a short-lived token minted from your AWS identity.
aws eks list-clusters | describe-cluster --name N | update-kubeconfig --name N [--alias A] | get-token | create-access-entry | ...You've been asked to look at the production EKS cluster and have never connected to it from this machine.
aws eksThe EKS control-plane API: clusters, node groups, add-ons, access entries.
update-kubeconfig calls DescribeCluster to get the API server endpoint and CA certificate, and writes a cluster, a context and a user to ~/.kube/config. The user has no password or certificate: it's an exec plugin that runs aws eks get-token. On every kubectl request, get-token builds a presigned STS GetCallerIdentity URL with your current AWS credentials, base64-encodes it as k8s-aws-v1.<...> and hands it to kubectl as a bearer token valid for about 15 minutes. The EKS API server's authenticator calls STS with that URL, learns your IAM ARN, then maps it to a Kubernetes identity: through access entries (the EKS API) and their access policies, or the older aws-auth ConfigMap. Kubernetes RBAC then decides what you may do. So 'Unauthorized' means the IAM identity isn't mapped; 'Forbidden' means it is mapped but RBAC says no.
kubectl gets a presigned STS URL from the AWS CLI; EKS uses it to learn your IAM identity and maps it to Kubernetes RBAC.
The kubeconfig user is an exec plugin. kubectl runs aws eks get-token, which uses your current AWS credentials (profile, env vars or role).
list-clustersCluster names in the regiondescribe-cluster --name NStatus, version, endpoint, auth mode, networkingupdate-kubeconfig --name NWrite kubeconfig entries; --alias, --role-arn, --profileget-token --cluster-name NPrint the ExecCredential kubectl uses (for debugging)create-access-entryLet an IAM principal into the cluster; then associate-access-policylist-access-entriesWhich IAM principals have accessupdate-nodegroup-configScale managed node groups (list-nodegroups to find them)describe-update --update-idTrack an asynchronous change (version upgrade, scaling)Running update-kubeconfig with one profile and kubectl with anotherget-token uses whatever credentials are active at kubectl time, so you authenticate as a different identity and get Unauthorized.
update-kubeconfig --profile prod (it's written into the kubeconfig), or keep AWS_PROFILE consistentEditing the aws-auth ConfigMap by hand to add usersA YAML mistake there can lock everyone, including nodes, out of the cluster.
Access entries via aws eks create-access-entry, and authentication mode APIAssuming the cluster creator will always have accessThat implicit admin is tied to one IAM identity; if it's a person's role that gets deleted, nobody can get in.
Explicit access entries for an admin role, managed in TerraformTry these on a Linux machine of your own. Each task has a hint and a solution.
Learn the token format: base64-decode the start of an EKS token, 'aHR0cHM6Ly9zdHMudXMtZWFzdC0xLmFtYXpvbmF3cy5jb20v', and see what it points to.
Add the staging-eks cluster in eu-west-1 to your kubeconfig with the context name staging, then list its namespaces with kubectl.
Give the IAM role dev-team read-only access to the namespace shop only, on prod-eks.