access_entries

Creates, updates, deletes, gets or lists an access_entries resource.

Overview

Name	access_entries
Type	Resource
Id	aws.eks.access_entries

Fields

The following fields are returned by SELECT queries:

describe_access_entry

Name	Datatype	Description
access_entry_arn	string	The ARN of the access entry.
cluster_name	string	The name of your cluster.
created_at	string (date-time)	The Unix epoch timestamp at object creation.
kubernetes_groups	array	A name that you've specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
modified_at	string (date-time)	The Unix epoch timestamp for the last modification to the object.
principal_arn	string	The ARN of the IAM principal for the access entry. If you ever delete the IAM principal with this ARN, the access entry isn't automatically deleted. We recommend that you delete the access entry with an ARN for an IAM principal that you delete. If you don't delete the access entry and ever recreate the IAM principal, even if it has the same ARN, the access entry won't work. This is because even though the ARN is the same for the recreated IAM principal, the roleID or userID (you can see this with the Security Token Service GetCallerIdentity API) is different for the recreated IAM principal than it was for the original IAM principal. Even though you don't see the IAM principal's roleID or userID for an access entry, Amazon EKS stores it with the access entry.
tags	object	Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
type_	string	The type of the access entry.
username	string	The name of a user that can authenticate to your cluster.

list_access_entries

Name	Datatype	Description
access_entry	string	The list of access entries that exist for the cluster.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_access_entry	select	name, principal_arn, region		Describes an access entry.
list_access_entries	select	name, region	associatedPolicyArn, maxResults, nextToken	Lists the access entries for your cluster.
create_access_entry	insert	name, region, principalArn		Creates an access entry. An access entry allows an IAM principal to access your cluster. Access entries can replace the need to maintain entries in the aws-auth ConfigMap for authentication. You have the following options for authorizing an IAM principal to access Kubernetes objects on your cluster: Kubernetes role-based access control (RBAC), Amazon EKS, or both. Kubernetes RBAC authorization requires you to create and manage Kubernetes Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects, in addition to managing access entries. If you use Amazon EKS authorization exclusively, you don't need to create and manage Kubernetes Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects. For more information about access entries, see Access entries in the Amazon EKS User Guide.
update_access_entry	update	name, principal_arn, region		Updates an access entry.
delete_access_entry	delete	name, principal_arn, region		Deletes an access entry. Deleting an access entry of a type other than Standard can cause your cluster to function improperly. If you delete an access entry in error, you can recreate it.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
name	string	The name of your cluster.
principal_arn	string	The ARN of the IAM principal for the AccessEntry.
region	string	AWS region (default: us-east-1)
associatedPolicyArn	string	The ARN of an AccessPolicy. When you specify an access policy ARN, only the access entries associated to that access policy are returned. For a list of available policy ARNs, use ListAccessPolicies.
maxResults	integer	The maximum number of results, returned in paginated output. You receive maxResults in a single page, along with a nextToken response element. You can see the remaining results of the initial request by sending another request with the returned nextToken value. This value can be between 1 and 100. If you don't use this parameter, 100 results and a nextToken value, if applicable, are returned.
nextToken	string	The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter. Pagination continues from the end of the previous results that returned the nextToken value. This value is null when there are no more results to return. This token should be treated as an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic purposes.

SELECT examples

describe_access_entry

Describes an access entry.

SELECT
access_entry_arn,
cluster_name,
created_at,
kubernetes_groups,
modified_at,
principal_arn,
tags,
type_,
username
FROM aws.eks.access_entries
WHERE name = '{{ name }}' -- required
AND principal_arn = '{{ principal_arn }}' -- required
AND region = '{{ region }}' -- required
;

list_access_entries

Lists the access entries for your cluster.

SELECT
access_entry
FROM aws.eks.access_entries
WHERE name = '{{ name }}' -- required
AND region = '{{ region }}' -- required
AND associatedPolicyArn = '{{ associatedPolicyArn }}'
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_access_entry

Creates an access entry. An access entry allows an IAM principal to access your cluster. Access entries can replace the need to maintain entries in the aws-auth ConfigMap for authentication. You have the following options for authorizing an IAM principal to access Kubernetes objects on your cluster: Kubernetes role-based access control (RBAC), Amazon EKS, or both. Kubernetes RBAC authorization requires you to create and manage Kubernetes Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects, in addition to managing access entries. If you use Amazon EKS authorization exclusively, you don't need to create and manage Kubernetes Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects. For more information about access entries, see Access entries in the Amazon EKS User Guide.

INSERT INTO aws.eks.access_entries (
principalArn,
kubernetesGroups,
tags,
clientRequestToken,
username,
type,
name,
region
)
SELECT 
'{{ principalArn }}' /* required */,
'{{ kubernetesGroups }}',
'{{ tags }}',
'{{ clientRequestToken }}',
'{{ username }}',
'{{ type }}',
'{{ name }}',
'{{ region }}'
RETURNING
access_entry
;

Manifest

# Description fields are for documentation purposes
- name: access_entries
props:
  - name: name
    value: "{{ name }}"
    description: Required parameter for the access_entries resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the access_entries resource.
  - name: principalArn
    value: "{{ principalArn }}"
  - name: kubernetesGroups
    value:
      - "{{ kubernetesGroups }}"
  - name: tags
    value: "{{ tags }}"
    description: |
      The metadata that you apply to a resource to help you categorize and organize them. Each tag consists of a key and an optional value. You define them. The following basic restrictions apply to tags: Maximum number of tags per resource – 50 For each resource, each tag key must be unique, and each tag key can have only one value. Maximum key length – 128 Unicode characters in UTF-8 Maximum value length – 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @. Tag keys and values are case-sensitive. Do not use aws:, AWS:, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for Amazon Web Services use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
  - name: clientRequestToken
    value: "{{ clientRequestToken }}"
  - name: username
    value: "{{ username }}"
  - name: type
    value: "{{ type }}"

UPDATE examples

update_access_entry

Updates an access entry.

UPDATE aws.eks.access_entries
SET 
kubernetesGroups = '{{ kubernetesGroups }}',
clientRequestToken = '{{ clientRequestToken }}',
username = '{{ username }}'
WHERE 
name = '{{ name }}' --required
AND principal_arn = '{{ principal_arn }}' --required
AND region = '{{ region }}' --required
RETURNING
access_entry;

DELETE examples

delete_access_entry

Deletes an access entry. Deleting an access entry of a type other than Standard can cause your cluster to function improperly. If you delete an access entry in error, you can recreate it.

DELETE FROM aws.eks.access_entries
WHERE name = '{{ name }}' --required
AND principal_arn = '{{ principal_arn }}' --required
AND region = '{{ region }}' --required
;