---
title: "EKS cluster scanning permissions | Lansweeper Platform"
slug: "configure-eks-cluster-scanning-permissions"
description: "Configure AWS IAM and Kubernetes RBAC so Lansweeper Cloud Discovery can read node, pod, service, and endpoint details from each Amazon EKS cluster you scan."
status: "new"
updated: 2026-07-30T12:54:21Z
published: 2026-07-30T12:54:21Z
canonical: "docs.lansweeper.com/configure-eks-cluster-scanning-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure EKS cluster scanning permissions

The standard AWS Cloud Discovery setup lets Lansweeper read your Amazon EKS clusters at the AWS level, such as cluster metadata and configuration. To read Kubernetes-level detail from inside a cluster, including nodes, pods, services, and endpoints, Lansweeper needs read access to the cluster's Kubernetes API.

This article explains how to grant that access. It supplements the standard AWS setup and applies per cluster: repeat these steps for each EKS cluster you want to inventory in detail.

              Complete the standard AWS setup first

              

These steps build on the standard AWS Cloud Discovery configuration. Complete [Prepare AWS for Cloud Discovery](/docs/prepare-aws-for-cloud-discovery) before you start.

## Prerequisites

Before you start, confirm the following:

- The standard AWS Cloud Discovery setup is complete, including the reader IAM role that Lansweeper assumes to read the account (for example, `LSReadingRole`). The steps below refer to it as the reader role.
- The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [kubectl](https://kubernetes.io/docs/tasks/tools/) are installed on your machine.
- You have an AWS identity with permissions to modify the target cluster, such as the cluster creator or an identity with administrative access to the cluster.
- The target cluster uses EKS access entries for authentication.

              Access entries replace the aws-auth ConfigMap

              

AWS has deprecated the `aws-auth` ConfigMap in favor of access entries and access policies. The steps below use access entries. For background, see [Grant IAM users and roles access to Kubernetes APIs](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html).

## Values to replace

The commands below use placeholders. Replace each one with a value from your environment:

| Placeholder | Replace with |
| --- | --- |
| `cluster-name` | The name of your EKS cluster |
| `region` | The AWS region of the cluster |
| `000000000000` | Your AWS account ID |
| `Role` | The name of the reader IAM role, for example `LSReadingRole` |
| `cloud-discovery-readonly` | A name for the read-only ClusterRole |
| `cloud-discovery-readonly-binding` | A name for the ClusterRoleBinding |

## Connect kubectl to your EKS cluster

1. Configure kubectl to use the target cluster. This points kubectl at the correct AWS credentials and cluster endpoint.

```
aws eks update-kubeconfig \
  --name cluster-name \
  --region region
```
2. Confirm which cluster context is active, so you modify the intended cluster.

```
kubectl config current-context
```
3. Confirm which AWS identity you're using. This identity must have permissions to modify the target cluster.

```
aws sts get-caller-identity
```

## Grant the reader role access to the cluster

Create an access entry that lets the reader IAM role authenticate to the cluster, then associate a read-only access policy with it.

1. Create an EKS access entry for the reader role.

```
aws eks create-access-entry \
  --cluster-name cluster-name \
  --region region \
  --principal-arn arn:aws:iam::000000000000:role/Role
```
2. Associate the AWS managed read-only view policy with the access entry. This authorizes the reader role through Kubernetes RBAC at the cluster scope.

```
aws eks associate-access-policy \
  --cluster-name cluster-name \
  --region region \
  --principal-arn arn:aws:iam::000000000000:role/Role \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy \
  --access-scope type=cluster
```

For more about access policies, see [Associate access policies with access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html).

## Create read-only Kubernetes permissions

Define a ClusterRole that grants read access to the resources Lansweeper needs, then bind it to the reader role.

1. Create a ClusterRole with read-only access to the target resources. Pods, nodes, endpoints, and services are the minimum required. Add more resources if you need broader discovery.

```
kubectl create clusterrole cloud-discovery-readonly \
  --verb=get,list,watch \
  --resource=pods,nodes,endpoints,services
```
2. Bind the ClusterRole to the reader IAM role. Any request from this role then receives the read-only permissions.

```
kubectl create clusterrolebinding cloud-discovery-readonly-binding \
  --clusterrole=cloud-discovery-readonly \
  --user arn:aws:iam::000000000000:role/Role
```

## Validate the reader role's access

Confirm that the reader role can read the target resources. Each command returns `yes` when the role has the expected access.

```
kubectl auth can-i get nodes --as arn:aws:iam::000000000000:role/Role
kubectl auth can-i get services --as arn:aws:iam::000000000000:role/Role
```

If a command returns `no`, review the access entry, the associated access policy, and the ClusterRoleBinding for the reader role.

## Next steps

With EKS access configured, run or update a Cloud Discovery action to scan the cluster.

- [Create a cloud action - AWS](/docs/create-a-cloud-action-aws)