{"id":17138364,"url":"https://github.com/alexei-led/eks-ro-access","last_synced_at":"2026-04-28T20:37:16.275Z","repository":{"id":39515342,"uuid":"248229305","full_name":"alexei-led/eks-ro-access","owner":"alexei-led","description":"EKS read-only access guide","archived":false,"fork":false,"pushed_at":"2022-06-24T11:52:20.000Z","size":16,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-24T07:19:29.839Z","etag":null,"topics":["aws","eks","iam","kubernetes"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexei-led.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-18T12:45:31.000Z","updated_at":"2022-06-24T11:29:46.000Z","dependencies_parsed_at":"2022-08-29T16:01:19.344Z","dependency_job_id":null,"html_url":"https://github.com/alexei-led/eks-ro-access","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/alexei-led/eks-ro-access","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexei-led%2Feks-ro-access","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexei-led%2Feks-ro-access/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexei-led%2Feks-ro-access/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexei-led%2Feks-ro-access/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexei-led","download_url":"https://codeload.github.com/alexei-led/eks-ro-access/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexei-led%2Feks-ro-access/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32398997,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-28T19:38:08.556Z","status":"ssl_error","status_checked_at":"2026-04-28T19:37:55.688Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","eks","iam","kubernetes"],"created_at":"2024-10-14T20:09:25.367Z","updated_at":"2026-04-28T20:37:16.256Z","avatar_url":"https://github.com/alexei-led.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Grant access to customer EKS Cluster\n\nSometimes you need to access customer-managed EKS cluster with public endpoint. Follow this guide to get a read-only access to customer-managed EKS cluster on customer AWS account.\n\n## Create IAM Role (cross-account) or temporary IAM User\n\n[AWS Cross AWS Account Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html)\n\nIn order to access EKS cluster you need AWS IAM credentials. The most secure way is to define a cross AWS account role and assume this role.\n\n### Cross-account IAM Role\n\n[![Launch Stack](https://s3.amazonaws.com/cloudformation-examples/cloudformation-launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=eks-ro-acccess\u0026templateURL=https://min.gitcdn.link/cdn/alexei-led/eks-ro-access/master/template.yaml)\n\nCloudFormation [template](./template.yaml) for read-only access to an EKS cluster.\n\n### Using temporary IAM User\n\nAnother, less secure option, is to create a temporary IAM User in customer AWS account.\n\nThen you need to attach IAM Policy to cross-account IAM Role or in-account IAM User.\n\nThe required IAM Policy (replace `\u003c\u003e` values):\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\"eks:DescribeCluster\", \"eks:ListClusters\"],\n            \"Resource\": \"arn:aws:eks:\u003cAWS_REGION\u003e:\u003cAWS_ACCOUNT\u003e:cluster/\u003cEKS_NAME\u003e\"\n        }\n    ]\n}\n```\n\n## Create ClusterRoleBinding to `view` ClusterRole\n\n[Kubernetes RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)\n\nEKS has a built-in `view` ClusterRole with `get,list,watch` access to all APIs and all resources.\n\nPlease, create a `support:viewer` ClusterRoleBinding to the `view` ClusterRole.\n\n```sh\ncat \u003c\u003cEOF | kubectl apply -f -\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  annotations:\n    rbac.authorization.kubernetes.io/autoupdate: \"true\"\n  name: support:viewer\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: view\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n  kind: Group\n  name: support:viewer\nEOF\n```\n\n## Add IAM role/user to aws-auth ConfigMap\n\n[AWS guide](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html)\n\nEdit `aws-auth` ConfigMap manually (`kubectl edit -n kube-system configmap/aws-auth` command) or with `eksctl create iamidentitymapping`, adding IAM User or IAM Role to `mapUsers` or `mapRoles` configuration.\n\nFor example:\n\n```sh\neksctl create iamidentitymapping --username viewer --group support:viewer --arn \u003cUSER_ARN|ROLE_ARN\u003e --cluster \u003cCLUSTER_NAME\u003e --region \u003cAWS_REGION\u003e\n```\n\n## Generate/update kubeconfig\n\n[AWS guide](https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html)\n\nGenerate/update `kubeconfig` for the EKS clusterm assuming IAM Role (from above) or using AWS credentials for temporary IAM User.\n\n```sh\naws eks --region \u003cAWS_REGION\u003e update-kubeconfig --name \u003cCLUSTER_NAME\u003e\n```\n\n## Additional References\n\n- [How do I manage permissions across namespaces for my IAM users in an Amazon EKS cluster?](https://aws.amazon.com/premiumsupport/knowledge-center/eks-iam-permissions-namespaces/)\n- [Read-Only Access to Kubernetes Cluster](https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698)\n- [eksctl: Manage IAM users and roles](https://eksctl.io/usage/iam-identity-mappings/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexei-led%2Feks-ro-access","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falexei-led%2Feks-ro-access","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexei-led%2Feks-ro-access/lists"}