Amazon EKS Cluster Access for Cloudaware

Configure Amazon EKS cluster access so Cloudaware can discover Kubernetes objects in your clusters.

Cloudaware connects to EKS using an AWS IAM role or user (the same identity you configure for the AWS integration) and then relies on Kubernetes RBAC inside the cluster. You can grant that IAM identity access to the cluster by using:

Access entries (recommended) – modern, AWS‑managed access control for EKS.
aws-auth ConfigMap (legacy) – configuration still used by older clusters.

This guide focuses on how to ensure the Cloudaware IAM role has read‑only Kubernetes permissions in either model.

Prerequisites

Access to a Cloudaware account.
A user with access to the Admin Console for managing integrations (Cloudaware Administrator).
An AWS account is configured with Cloudaware as described in AWS Setup Guide, using a cross‑account IAM role or dedicated IAM user created for Cloudaware.
An EKS cluster you want Cloudaware to monitor.
kubectl configured for the cluster and permissions to edit EKS access settings and Kubernetes RBAC (cluster‑admin or equivalent).

Access Model Overview

EKS authenticates Kubernetes requests using AWS IAM and then authorizes them using Kubernetes RBAC:

Authentication – Map the Cloudaware IAM role/user into the cluster (using access entries or aws-auth).
Authorization – Grant the mapped Kubernetes user/group a ClusterRole with read‑only permissions.

Cloudaware does not require write access to cluster resources for discovery.

Configuration

The following options are available:

Access Entries (Recommended)

Access entries are the preferred way to manage EKS access for IAM principals.

Before you begin, ensure that:

The cluster meets one of the requirements for using access entries (platform/Kubernetes versions). Read more
The access entry as a cluster authentication mode is enabled in AWS. Read more
Existing aws-auth ConfigMap entries are migrated to access entries (optional). Read more

At a high level:

In the AWS console, open Amazon EKS → your cluster.
Go to the Access configuration.
Create or update an access entry for the IAM role (or user) that Cloudaware uses for that account.
Associate the access entry with:
- A Kubernetes user or group that will represent Cloudaware in the cluster, and
- A Kubernetes permission profile that grants read‑only access (for example, a role bound to a cloudaware-reader ClusterRole as shown below).

Use AWS documentation for the exact steps to enable and configure access entries for your cluster and Kubernetes version.

If you need more granular control, you can still define your own ClusterRole and ClusterRoleBinding and reference the corresponding Kubernetes user/group from the access entry.

`aws-auth` ConfigMap (Legacy)

Clusters created before access entries, or clusters still using legacy configuration, rely on the aws-auth ConfigMap in the kube-system namespace to map IAM identities into Kubernetes users and groups.

You can either grant full administrative access or a dedicated read‑only role.

Full Access (system:masters)

This approach is easy but gives Cloudaware administrative rights in the cluster. Prefer the read‑only model below unless you have a specific need for admin‑level visibility.

Ensure you can connect to the cluster and have permission to edit the ConfigMap.
Open the aws-auth ConfigMap:

kubectl edit -n kube-system configmap/aws-auth

Add a mapRoles entry for the Cloudaware IAM role, if one does not already exist:

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: <CLOUDAWARE_ROLE_ARN>
      username: cloudaware
      groups:
        - system:masters

Where:

<CLOUDAWARE_ROLE_ARN> is the ARN of the IAM role Cloudaware uses in that AWS account.
system:masters gives cluster‑admin level permissions. Use with caution.

For more information on cluster roles, see also Default Roles and Role Bindings.

Read‑Only Access with Dedicated RBAC

To grant read‑only access while keeping RBAC explicit:

Create a Kubernetes RBAC manifest, for example, cloudaware-rbac.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudaware-reader
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudaware-binding
subjects:
- kind: User
  name: cloudaware
  namespace: default
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: cloudaware-reader
  apiGroup: ""

Where:

The cloudaware-reader ClusterRole grants read‑only access (get, watch, list) across APIs and resources.
The cloudaware-binding ClusterRoleBinding attaches that role to the Kubernetes user cloudaware.

Apply the RBAC configuration:
```
kubectl apply -f cloudaware-rbac.yaml
```

Map the Cloudaware IAM role to the cloudaware Kubernetes user in the aws-auth ConfigMap:

kubectl -n kube-system edit configmap aws-auth

Add or update the relevant mapRoles entry:

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: <CLOUDAWARE_ROLE_ARN>
      username: cloudaware

Where <CLOUDAWARE_ROLE_ARN> is the Cloudaware IAM role ARN for the EKS account.

note

Do not remove existing entries in mapRoles or mapUsers. Append the Cloudaware mapping alongside existing mappings.

Verification in Cloudaware

After authentication and RBAC are configured:

Allow time for the next discovery cycle.
In Cloudaware CMDB Navigator, browse to Amazon Web Services → Compute → EKS.
Confirm that EKS cluster objects (namespaces, nodes, pods, services, role bindings, etc.) are populated.

Troubleshooting

If EKS resources do not appear:

Verify that:
- The Cloudaware IAM role is correctly mapped via access entries or aws-auth.
- The associated Kubernetes user/group has the cloudaware-reader ClusterRole (or equivalent read‑only role).
- The AWS integration role has the required permissions defined in the AWS least‑privilege and IAM policies docs.
Check EKS and Kubernetes audit logs for denied API calls.

Supported EKS Objects

AWS EKS Object	CMDB Object API Name
AWS EKS Cluster	`CA10A1__CaAwsEksCluster__c`
AWS EKS Cluster Config Map	`CA10A1__CaAwsEksClusterConfigMap__c`
AWS EKS Cluster Daemon Set	`CA10A1__CaAwsEksClusterDaemonSet__c`
AWS EKS Cluster Deployment	`CA10A1__CaAwsEksClusterDeployment__c`
AWS EKS Cluster Endpoint	`CA10A1__CaAwsEksClusterEndpoint__c`
AWS EKS Cluster Fact	`CA10A1__CaAwsEksClusterFact__c`
AWS EKS Cluster Fargate Profile	`CA10A1__CaAwsEksClusterFargateProfile__c`
AWS EKS Cluster Fargate Profile Subnet	`CA10A1__CaAwsEksClusterFargateProfileSubnetLink__c`
AWS EKS Cluster HPA	`CA10A1__CaAwsEksClusterHpa__c`
AWS EKS Cluster Ingress	`CA10A1__CaAwsEksClusterIngress__c`
AWS EKS Cluster Limit Range	`CA10A1__CaAwsEksClusterLimitRange__c`
AWS EKS Cluster Namespace	`CA10A1__CaAwsEksClusterNamespace__c`
AWS EKS Cluster Network Policy	`CA10A1__CaAwsEksClusterNetworkPolicy__c`
AWS EKS Cluster Network Policy Rule	`CA10A1__CaAwsEksClusterNetworkPolicyRule__c`
AWS EKS Cluster Node	`CA10A1__CaAwsEksClusterNode__c`
AWS EKS Cluster Node Address	`CA10A1__CaAwsEksClusterNodeAddress__c`
AWS EKS Cluster Node Condition	`CA10A1__CaAwsEksClusterNodeCondition__c`
AWS EKS Cluster Node Group	`CA10A1__CaAwsEksClusterNodeGroup__c`
AWS EKS Cluster Node Group Subnet Link	`CA10A1__CaAwsEksClusterNodeGroupSubnetLink__c`
AWS EKS Cluster Pod	`CA10A1__CaAwsEksClusterPod__c`
AWS EKS Cluster Pod Container	`CA10A1__CaAwsEksClusterPodContainer__c`
AWS EKS Cluster Pod Disruption Budget	`CA10A1__CaAwsEksClusterPodDisruptionBudget__c`
AWS EKS Cluster Replica Set	`CA10A1__CaAwsEksClusterReplicaSet__c`
AWS EKS Cluster Resource Quota	`CA10A1__CaAwsEksClusterResourceQuota__c`
AWS EKS Cluster Role	`CA10A1__CaAwsEksClusterRole__c`
AWS EKS Cluster Role Binding	`CA10A1__CaAwsEksClusterRoleBinding__c`
AWS EKS Cluster Secret	`CA10A1__CaAwsEksClusterSecret__c`
AWS EKS Cluster Security Group Link	`CA10A1__CaAwsEksClusterSecurityGroupLink__c`
AWS EKS Cluster Service	`CA10A1__CaAwsEksClusterService__c`
AWS EKS Cluster Service Account	`CA10A1__CaAwsEksClusterServiceAccount__c`
AWS EKS Cluster Service Account Secret	`CA10A1__CaAwsEksClusterServiceAccountSecret__c`
AWS EKS Cluster Stateful Set	`CA10A1__CaAwsEksClusterStatefulSet__c`
AWS EKS Cluster Storage Class	`CA10A1__CaAwsEksClusterStorageClass__c`
AWS EKS Cluster Subnet Link	`CA10A1__CaAwsEksClusterSubnetLink__c`

Prerequisites​

Access Model Overview​

Configuration​

Access Entries (Recommended)​

aws-auth ConfigMap (Legacy)​

Full Access (system:masters)​

Read‑Only Access with Dedicated RBAC​

Verification in Cloudaware​

Troubleshooting​

Supported EKS Objects​

Related​