training/data/raw/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md

AWS EKS access setup

You can enable AWS DevOps Agent to investigate issues in your Amazon EKS clusters by running read-only kubectl commands against both public and private clusters.

Once connected, the agent can help diagnose operational issues — describing resources, retrieving pod logs, inspecting cluster events, checking node health, and more. The agent cannot create, modify, or delete any resources in your cluster.

Prerequisites

Ensure that your EKS cluster's authentication mode includes the EKS API. Check on the Access tab in the Amazon EKS console.

Setup

1. Go to the Access tab in the EKS console.
2. Create a new IAM access entry with your primary cloud source IAM role ARN.
3. Select the AmazonAIOpsAssistantPolicy access policy with Cluster access scope.
4. Review and create the access entry.

Troubleshooting

If the agent can't reach your cluster, verify that the access entry is using the correct IAM role ARN and that the AmazonAIOpsAssistantPolicy access policy is attached.