Configure EKS cluster scanning permissions

The standard AWS Cloud Discovery setup lets Lansweeper read your Amazon EKS clusters at the AWS level, such as cluster metadata and configuration. To read Kubernetes-level detail from inside a cluster, including nodes, pods, services, and endpoints, Lansweeper needs read access to the cluster's Kubernetes API.

This article explains how to grant that access. It supplements the standard AWS setup and applies per cluster: repeat these steps for each EKS cluster you want to inventory in detail.

Prerequisites

Before you start, confirm the following:

• The standard AWS Cloud Discovery setup is complete, including the reader IAM role that Lansweeper assumes to read the account (for example, LSReadingRole). The steps below refer to it as the reader role.
• The AWS CLI and kubectl are installed on your machine.
• You have an AWS identity with permissions to modify the target cluster, such as the cluster creator or an identity with administrative access to the cluster.
• The target cluster uses EKS access entries for authentication.

Values to replace

The commands below use placeholders. Replace each one with a value from your environment:

Connect kubectl to your EKS cluster

1. Configure kubectl to use the target cluster. This points kubectl at the correct AWS credentials and cluster endpoint.

   aws eks update-kubeconfig \
     --name cluster-name \
     --region region
   

2. Confirm which cluster context is active, so you modify the intended cluster.

   kubectl config current-context
   

3. Confirm which AWS identity you're using. This identity must have permissions to modify the target cluster.

   aws sts get-caller-identity
   

Grant the reader role access to the cluster

Create an access entry that lets the reader IAM role authenticate to the cluster, then associate a read-only access policy with it.

1. Create an EKS access entry for the reader role.

   aws eks create-access-entry \
     --cluster-name cluster-name \
     --region region \
     --principal-arn arn:aws:iam::000000000000:role/Role
   

2. Associate the AWS managed read-only view policy with the access entry. This authorizes the reader role through Kubernetes RBAC at the cluster scope.

   aws eks associate-access-policy \
     --cluster-name cluster-name \
     --region region \
     --principal-arn arn:aws:iam::000000000000:role/Role \
     --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy \
     --access-scope type=cluster
   

   For more about access policies, see Associate access policies with access entries.

Create read-only Kubernetes permissions

Define a ClusterRole that grants read access to the resources Lansweeper needs, then bind it to the reader role.

1. Create a ClusterRole with read-only access to the target resources. Pods, nodes, endpoints, and services are the minimum required. Add more resources if you need broader discovery.

   kubectl create clusterrole cloud-discovery-readonly \
     --verb=get,list,watch \
     --resource=pods,nodes,endpoints,services
   

2. Bind the ClusterRole to the reader IAM role. Any request from this role then receives the read-only permissions.

   kubectl create clusterrolebinding cloud-discovery-readonly-binding \
     --clusterrole=cloud-discovery-readonly \
     --user arn:aws:iam::000000000000:role/Role
   

Validate the reader role's access

Confirm that the reader role can read the target resources. Each command returns yes when the role has the expected access.

kubectl auth can-i get nodes --as arn:aws:iam::000000000000:role/Role
kubectl auth can-i get services --as arn:aws:iam::000000000000:role/Role

If a command returns no, review the access entry, the associated access policy, and the ClusterRoleBinding for the reader role.

Next steps

With EKS access configured, run or update a Cloud Discovery action to scan the cluster.

• Create a cloud action - AWS