training/data/raw/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md

# AWS EKS access setup

You can enable AWS DevOps Agent to investigate issues in your Amazon EKS clusters by running read-only kubectl commands against both public and private clusters.

Once connected, the agent can help diagnose operational issues — describing resources, retrieving pod logs, inspecting cluster events, checking node health, and more. The agent cannot create, modify, or delete any resources in your cluster.

## Prerequisites

Ensure that your EKS cluster's authentication mode includes the EKS API. Check on the Access tab in the Amazon EKS console.

## Setup

1. Go to the Access tab in the EKS console.
2. Create a new IAM access entry with your primary cloud source IAM role ARN.
3. Select the AmazonAIOpsAssistantPolicy access policy with Cluster access scope.
4. Review and create the access entry.

## Troubleshooting

If the agent can't reach your cluster, verify that the access entry is using the correct IAM role ARN and that the AmazonAIOpsAssistantPolicy access policy is attached.