AWS EKS | DevOps QuickRef | DevOps QuickRef

EKS is AWS's managed Kubernetes control plane. Once kubectl is pointed at it, the Kubernetes cheat sheet applies directly — this page covers the EKS-specific setup around it.

Cluster Access

aws eks list-clusters

Lists EKS clusters in the current region.

aws eks update-kubeconfig --name my-cluster

Adds (or updates) an entry in ~/.kube/config for the cluster, and sets it as the current context — the standard first step after a cluster exists.

aws eks describe-cluster --name my-cluster

Shows cluster detail: Kubernetes version, endpoint, VPC config and status.

Why kubectl auth can fail even with valid AWS credentials

EKS authenticates kubectl via an aws eks get-token-style exec plugin baked into kubeconfig by update-kubeconfig — your IAM identity still needs to be mapped to a Kubernetes RBAC identity via the cluster's access entries (or the legacy aws-auth ConfigMap) before it can do anything inside the cluster. Valid AWS credentials alone don't imply any Kubernetes permissions.

Node Groups

aws eks list-nodegroups --cluster-name my-cluster

Lists managed node groups attached to a cluster.

aws eks describe-nodegroup --cluster-name my-cluster --nodegroup-name my-nodes

Shows a node group's instance type, scaling config, and status.

aws eks update-nodegroup-config --cluster-name my-cluster --nodegroup-name my-nodes --scaling-config minSize=2,maxSize=6,desiredSize=3

Updates a node group's scaling bounds without replacing it.

IRSA (IAM Roles for Service Accounts)

IRSA lets a specific Kubernetes ServiceAccount assume an IAM role, so a pod gets scoped AWS permissions without sharing broad node-level credentials with every pod on that node.

aws eks describe-cluster --name my-cluster --query cluster.identity.oidc.issuer

Shows the cluster's OIDC issuer URL, needed to set up an IAM role's trust policy for IRSA.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/my-app-role

Add-ons

aws eks list-addons --cluster-name my-cluster

Lists EKS-managed add-ons (VPC CNI, CoreDNS, kube-proxy, EBS CSI driver) on a cluster.

aws eks describe-addon --cluster-name my-cluster --addon-name vpc-cni

Shows an add-on's current version and health.