{"id":21042765,"url":"https://github.com/aws-observability/amp-eks-iam","last_synced_at":"2025-05-15T17:31:07.208Z","repository":{"id":54311771,"uuid":"340516005","full_name":"aws-observability/amp-eks-iam","owner":"aws-observability","description":"Tool providing easy IAM setup on EKS for Amazon Managed Service for Prometheus (AMP) users.","archived":false,"fork":false,"pushed_at":"2023-10-11T23:23:16.000Z","size":25,"stargazers_count":11,"open_issues_count":2,"forks_count":2,"subscribers_count":18,"default_branch":"main","last_synced_at":"2025-04-03T12:11:25.956Z","etag":null,"topics":["amp","iam","prometheus"],"latest_commit_sha":null,"homepage":"https://aws.amazon.com/prometheus","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aws-observability.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-02-19T23:39:32.000Z","updated_at":"2024-02-22T05:40:56.000Z","dependencies_parsed_at":"2024-06-20T12:03:24.614Z","dependency_job_id":null,"html_url":"https://github.com/aws-observability/amp-eks-iam","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Famp-eks-iam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Famp-eks-iam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Famp-eks-iam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Famp-eks-iam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aws-observability","download_url":"https://codeload.github.com/aws-observability/amp-eks-iam/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254388057,"owners_count":22062977,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amp","iam","prometheus"],"created_at":"2024-11-19T14:08:56.822Z","updated_at":"2025-05-15T17:31:05.724Z","avatar_url":"https://github.com/aws-observability.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🔑 amp-eks-iam\n\namp-eks-iam creates an IAM role to give\nremote write privileges to an EKS service account. If you are\ncollecting Prometheus metrics on EKS and want to send them to [Amazon\nManaged Service for Prometheus (AMP)](https://aws.amazon.com/prometheus/),\nyou can use this tool to give minimal privileges to your Kubernetes\nnamespace and service account.\n\n## Installation\n```\n$ go get github.com/aws-observability/amp-eks-iam\n```\n\n## Usage\n\n```\namp-eks-iam \u003ccluster flags\u003e [options...]\n\namp-eks-iam creates the required IAM policies and roles to give\nremote write priviledges to an EKS service account.\n\nExample:\n$ amp-eks-iam \\\n   -region=us-east-1 -cluster=eks-cluster\n\nCluster flags:\n-cluster         EKS cluster name.\n\nOptions:\n-namespace       Kubernetes namespace to apply the policy to. By default, \"prometheus\".\n-service-account Kubernetes service account to apply the policy to. By default, the namespace.\n-role            IAM role name to create, default is\n                 \"EKS-AMP-ServiceAccount-{region}-{cluster}-{namespace}-{sa}\".\n-region          AWS region of the EKS cluster.\n```\n\nBy default, amp-eks-iam creates the role and the privileges for the\n\"prometheus\" Kubernetes namespace and service account. You can specify your own\nnamespaces and service accounts. For example, if you are deploying Grafana Agent\nas explained [in this article](https://aws.amazon.com/blogs/opensource/configuring-grafana-cloud-agent-for-amazon-managed-service-for-prometheus/),\nuse the following command:\n\n```\n$ amp-eks-iam \\\n   -region=us-east-1 -cluster=eks-cluster \\\n   -namespace=grafana-agent \\\n   -service-account=grafana-agent\n```\n\n## Troubleshooting\n\nIf you received an error telling \"roleName\" is above the character limits like below,\n\n```\n2021/02/20 09:46:27 Cannot create IAM role: failed to create the IAM role: ValidationError: 1 validation error detected: Value 'EKS-AMP-ServiceAccount-us-west-2-demo-prometheusdeployment-prometheusdeploymentaccount' at 'roleName' failed to satisfy constraint: Member must have length less than or equal to 64\n```\n\nYou can set a custom role name with -role:\n\n```\n$ amp-eks-iam \\\n   -region=us-east-1 -cluster=eks-cluster \\\n   -role AMPIngestRole\n```\n\n## Security\n\nSee [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-observability%2Famp-eks-iam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faws-observability%2Famp-eks-iam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-observability%2Famp-eks-iam/lists"}