Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

Want to contribute to this user guide? Scroll to the bottom of this page and select Edit this page on GitHub. Your contributions will help make our user guide better for everyone.

Setting up to use Amazon EKS

Amazon resources typically have access restrictions that limit access to the Amazon entity that created them. Therefore, it's crucial to establish proper user configuration in the Amazon Command Line Interface from the beginning. Additionally, you need to equip your local machine with essential tools for efficient command-line management of your Amazon EKS cluster. This topic will help you prepare for the command-line management of your cluster.

Step 1: Set up the Amazon CLI

The Amazon CLI is a command line tool for working with Amazon services, including Amazon EKS. It is also used to authenticate IAM users or roles for access to the Amazon EKS cluster and other Amazon resources from your local machine. To provision resources in Amazon from the command line, you need to obtain an Amazon access key ID and secret key to use in the command line. Then you need to configure these credentials in the Amazon CLI. If you haven't already installed the Amazon CLI, see Install or update the latest version of the Amazon CLI in the Amazon Command Line Interface User Guide.

To create an access key

To configure the Amazon CLI

After installing the Amazon CLI, do the following steps to configure it. For more information, see Configure the Amazon CLI in the Amazon Command Line Interface User Guide.

To get a security token

If needed, run the following command to get a new security token for the Amazon CLI. For more information, see get-session-token in the Amazon CLI Command Reference.

By default, the token is valid for 15 minutes. To change the default session timeout, pass the --duration-seconds flag. For example:

aws sts get-session-token --duration-seconds 3600

This command returns the temporary security credentials for an Amazon CLI session. You should see the following response output:

{
    "Credentials": {
        "AccessKeyId": "ASIA5FTRU3LOEXAMPLE",
        "SecretAccessKey": "JnKgvwfqUD9mNsPoi9IbxAYEXAMPLE",
        "SessionToken": "VERYLONGSESSIONTOKENSTRING",
        "Expiration": "2023-02-17T03:14:24+00:00"
    }
}

To verify the user identity

If needed, run the following command to verify the Amazon credentials for your IAM user identity (such as ClusterAdmin) for the terminal session.

aws sts get-caller-identity

This command returns the Amazon Resource Name (ARN) of the IAM entity that's configured for the Amazon CLI. You should see the following example response output:

{
    "UserId": "AKIAIOSFODNN7EXAMPLE",
    "Account": "01234567890",
    "Arn": "arn:aws-cn:iam::01234567890:user/ClusterAdmin"
}

Step 2: Install Kubernetes tools

To communicate with a Kubernetes cluster, you will need a tool to interact with the Kubernetes API. Additionally, you need a few other tools, such as one to manage Kubernetes environments on your local machine.

To create Amazon resources

To install kubectl

kubectl is an open source command line tool used to communicate with the Kubernetes API server on your Amazon EKS cluster. If you don't already have it installed on your local machine, choose from the following options.

To set up a development environment

Next steps