~/ nmadiraju.com Amazon EKS · Access entries
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Access Entries Work on Amazon EKS

Follow the platform team letting role dev-team and a CI role into cluster shop-prod, then check yourself with 8 questions.

1Visual Walkthrough

IAM principals mapped to Kubernetes permissions through EKS access entries Left, Ana with role platform-admin, Sam with role teams/dev-team, and a CI pipeline with role ci-deploy. An AWS account holds the Amazon EKS API, the deleted creator role eks-creator, and the cluster's access entries. The API server authenticates against the entries, then the RBAC and EKS authorizers decide. Inside cluster shop-prod are the aws-auth ConfigMap and namespace shop with Deployment web and two RoleBindings. The walkthrough shows a lockout and recovery, the authentication modes, a session ARN mistake, a namespace-scoped View policy, groups with RBAC, combined permissions and a recreated role. Ana · platform role platform-admin Sam · dev-team role teams/dev-team CI pipeline role ci-deploy AWS ACCOUNT 111122223333 Amazon EKS API IAM decides who may call it eks-creator IAM role created shop-prod DELETED ACCESS ENTRIES · shop-prod role/platform-admin role/teams/dev-team role/ci-deploy role/ng-general-node KUBERNETES API SERVER 1 · Authentication IAM token → which entry? RBAC your bindings EKS authorizer access policies 2 · AUTHORIZATION either may allow · neither denies CLUSTER shop-prod ConfigMap aws-auth kube-system mapRoles: ng-general node role NOT READ NAMESPACE shop Deployment web 3 Pods · web-7d9f… + Secret db-creds RoleBinding deployer Role deployer → ci-deployers RoleBinding restarter Role restarter → shop-oncall

    2Quiz to check understanding

    Check yourself