~/ nmadiraju.com Amazon EKS · Access entries
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Access Entries Work on Amazon EKS

Follow Sam, a developer, from a 401 to working kubectl on cluster shop-prod, then check yourself with 8 questions.

1Visual Walkthrough

IAM principals mapped to Kubernetes permissions through EKS access entries Left, Ana with role platform-admin and Sam with role teams/dev-team, and a counter for what Sam's kubectl gets back. An AWS account holds the Amazon EKS API, the deleted creator role eks-creator, and the cluster's access entries. The API server authenticates against the entries, then the RBAC and EKS authorizers decide. Inside cluster shop-prod are the aws-auth ConfigMap and namespace shop with Deployment web and a RoleBinding. The walkthrough shows a lockout and recovery, the switch to access entries only, a session ARN mistake, a namespace-scoped View policy, a group with RBAC, and a recreated role. Ana · platform role platform-admin Sam · developer role teams/dev-team AWS ACCOUNT 111122223333 Amazon EKS API IAM decides who may call it eks-creator IAM role created shop-prod DELETED ACCESS ENTRIES · shop-prod role/platform-admin role/teams/dev-team role/ng-general-node KUBERNETES API SERVER 1 · Authentication IAM token → which entry? RBAC your bindings EKS authorizer access policies 2 · AUTHORIZATION either one's allow is enough CLUSTER shop-prod ConfigMap aws-auth kube-system mapRoles: ng-general node role NOT READ NAMESPACE shop Deployment web 3 Pods · web-7d9f… + Secret db-creds RoleBinding restarter Role restarter → shop-oncall

    2Quiz to check understanding

    Check yourself