AWS devopsagent documentation change
Summary
Completely rewrote EKS access setup documentation with detailed prerequisites, setup steps, troubleshooting, and clarified that agent has read-only access only
Security assessment
The change adds detailed security documentation about IAM role configuration, access policies (AmazonAIOpsAssistantPolicy), and clarifies the agent has read-only access only (cannot create, modify, or delete resources). This improves security posture by providing clear guidance on least-privilege access setup for EKS clusters.
Diff
diff --git a/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md b/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md index 3a8d422c6..2ebf91c8c 100644 --- a//devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md +++ b//devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-aws-eks-access-setup.md @@ -4,0 +5,2 @@ +PrerequisitesSetupTroubleshooting + @@ -7 +9,24 @@ -You can enable AWS DevOps Agent to describe your Kubernetes cluster objects, retrieve pod logs and cluster events, for either public or private AWS EKS clusters (only accessible with a VPC). +You can enable AWS DevOps Agent to investigate issues in your Amazon EKS clusters by running read-only `kubectl` commands against both public and private clusters. You can connect any number of EKS clusters to the same Agent Space. + +Once connected, the agent can help diagnose operational issues in your clusters — describing resources, retrieving pod logs, inspecting cluster events, checking node health, and more. The agent cannot create, modify, or delete any resources in your cluster. + +## Prerequisites + +Before setting up EKS access, ensure that your EKS cluster's authentication mode includes the EKS API. You can check this on the **Access** tab in the [Amazon EKS console](https://console.aws.amazon.com/eks). If the mode doesn't include the EKS API, select a mode that does before proceeding. + +## Setup + +These steps need to be completed from the [Amazon EKS console](https://console.aws.amazon.com/eks) for each cluster you wish to create an access entry for. You can find your IAM role ARN in your Agent Space (see [Creating an Agent Space](./getting-started-with-aws-devops-agent-creating-an-agent-space.html)) under **Capabilities > Cloud > Primary Source > Edit**. + + 1. Go to the **Access** tab. If the Authentication mode already says EKS API, you can add access entries. Otherwise, select a mode that includes the EKS API. + + 2. From the Access tab, create a new IAM access entry. Copy your primary cloud source IAM role ARN and enter it as the IAM principal for the access entry. Click **Next**. + + 3. Select the AWS Managed **AmazonAIOpsAssistantPolicy** access policy, and select **Cluster** for the access scope. (Alternatively, if you'd like the agent to only access certain namespaces, select the desired **Kubernetes Namespaces**). Click on **Add Policy** , and then click on **Next**. + + 4. Review the changes and confirm that the correct access entry policy and IAM role were chosen, and create your access entry by clicking **"Create"**. + + + + +To verify that the EKS access was configured correctly, navigate to the Operator App and start a new investigation, asking the agent a question about your cluster, such as "list all pods in the default namespace" or "show me recent events in my cluster". @@ -9 +34 @@ You can enable AWS DevOps Agent to describe your Kubernetes cluster objects, ret -Within a DevOps Agent Space navigate to Capabilities > Cloud > Primary Source > Edit and follow the setup instructions. +## Troubleshooting @@ -11 +36 @@ Within a DevOps Agent Space navigate to Capabilities > Cloud > Primary Source > - +If the agent can't reach your cluster, verify that the access entry is using the correct IAM role ARN shown in the setup dialog and that the **AmazonAIOpsAssistantPolicy** access policy is attached. @@ -19 +44 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configuring capabilities for AWS DevOps Agent +Migrating from public preview to general availability @@ -21 +46 @@ Configuring capabilities for AWS DevOps Agent -Connecting to CI/CD pipelines +Connecting Azure