{"id":19748685,"url":"https://github.com/doitintl/grant-eks-ro-access","last_synced_at":"2026-03-02T17:04:49.666Z","repository":{"id":240892377,"uuid":"803693901","full_name":"doitintl/grant-eks-ro-access","owner":"doitintl","description":"provide a script and all the needed resources to grant eks accesses to a AWS IAM","archived":false,"fork":false,"pushed_at":"2025-05-19T11:53:31.000Z","size":54,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-12-01T08:23:10.240Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/doitintl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-05-21T08:02:01.000Z","updated_at":"2025-05-19T11:53:35.000Z","dependencies_parsed_at":"2024-05-21T10:24:14.607Z","dependency_job_id":"0261c00b-640b-43d9-83bc-a2f1bad2a64e","html_url":"https://github.com/doitintl/grant-eks-ro-access","commit_stats":null,"previous_names":["doitintl/grant-eks-ro-access"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/doitintl/grant-eks-ro-access","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fgrant-eks-ro-access","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fgrant-eks-ro-access/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fgrant-eks-ro-access/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fgrant-eks-ro-access/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/doitintl","download_url":"https://codeload.github.com/doitintl/grant-eks-ro-access/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fgrant-eks-ro-access/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30011191,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-02T17:00:27.440Z","status":"ssl_error","status_checked_at":"2026-03-02T17:00:03.402Z","response_time":60,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T02:22:57.106Z","updated_at":"2026-03-02T17:04:49.601Z","avatar_url":"https://github.com/doitintl.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Grant read-only access to a EKS cluster\n\nThe script automates all the steps needed to grant read-only access to a EKS.\nIt also lets the to revoke the provided accesses.\n\n## How To\n\n### Requirements\n\nBefore executing the script you need to install:\n- jq\n- kubectl\n- eksctl\n- aws cli\n\nYou need to have admin permissions to the cluster.\nThere requirements are tested by the script.\n\n\n### Grant read-only accesses:\n\n```bash\n./grant-ro-accesses.sh --grant \u003cregion\u003e \u003cclusterName\u003e \u003carn\u003e\n```\n\nInputs to provide:\n\n- region: aws region where the cluster is\n- clusterName: eks cluster name\n- arn: IAM arn to provide accesses to\n\n**Example:**\n\n```bash\n./grant-ro-accesses.sh --grant eu-west-1 cluster_name arn:aws:iam::123456789000:user/programmatic/eks_user\n```\n\n\n### Revoke accesses:\n\n```bash\n./grant-ro-accesses.sh --revoke \u003cregion\u003e \u003cclusterName\u003e \u003carn\u003e\n```\n\nInputs to provide:\n\n- region: aws region where the cluster is\n- clusterName: eks cluster name\n- arn: IAM arn to provide accesses to\n\n\n**Example:**\n\n```bash\n./grant-ro-accesses.sh --revoke eu-west-1 cluster_name arn:aws:iam::123456789000:user/programmatic/eks_user\n```\n\n\n\n## How does it work\n\nThis script leverage two EKS authentication methods providing permission to an AWS IAM entity:\n- ConfigMap aws-auth: today deprecated but used by the majority of current clusters\n- Access Entries: the recommended way\n\n\nIn both scenarios, a Cluster Role with read-only permissions is created and bound to a kubernetes group “doit-viewer”: the AWS IAM ARN will be added to this group, acquiring read-only permissions provided by the ClusterRole.\nBased on the cluster configuration, this last step is made with ConfigMap aws-auth or Access Entries.\n\n![Alt Text](./doc_resources/goal-of-the-script.svg)\n\n\n### Flow process of the script\n\n![Alt Text](./doc_resources/schema.svg)\n\n\n### Preserve aws-auth configmap history\n\nIn case the cluster is configured to use config map as authentication, before any update of the config map, its current status is backed up to the file aws-config_history.yaml\n\n\n## Features\n\nThe script:\n\n- provides the ability to grant and remove permissions\n- is robust: any prerequisite is tested\n- is idempotent: you can run it any time and have the same result (feature ongoing)\n\n\n## Kubernetes permissions\n\nKubernetes permissions are defined by the ClusterRole 'doit:view' defined in the file resources/k8s_objects.yaml.\nCurrently this identical to the standard ClusterRole 'view' provided by kubernetes with the add of the last group of permissions letting to have read-only accesses to nodes.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fgrant-eks-ro-access","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdoitintl%2Fgrant-eks-ro-access","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fgrant-eks-ro-access/lists"}