# Integrate with EKS

With Elastic Kubernetes Service (EKS) on AWS, EKS simplifies the management complexities of Kubernetes.

Through this integration, Apono helps you securely manage access to your AWS Elastic Kubernetes cluster.​

***

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

<table data-header-hidden><thead><tr><th width="216"></th><th></th></tr></thead><tbody><tr><td>Item</td><td>Description</td></tr><tr><td><strong>Apono Connector</strong></td><td>​<a href="../../kubernetes-environment/apono-connector-for-kubernetes">Connection</a> installed on the EKS cluster that serves as a bridge between the cluster and Apono</td></tr><tr><td><strong>Apono Premium</strong></td><td>​<a href="https://www.apono.io/pricing/">Apono plan</a> providing all available features and dedicated account support</td></tr><tr><td><strong>Cluster Admin Access</strong></td><td>Admin access to the cluster to integrate The cluster admin access can be the built-in <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles">cluster-admin</a> role or equivalent permission level. Apono does not require admin permissions to the Kubernetes environment.</td></tr><tr><td><strong>EKS Cluster Name</strong></td><td>Unique <a href="https://docs.aws.amazon.com/cli/latest/reference/eks/list-clusters.html">name of the cluster</a> to integrate</td></tr><tr><td><strong>AWS SSO | SAML Federation</strong></td><td>Authentication for requester Security Assertion Markup Language (SAML) federation for authentication can be provided by providers such as Okta, Onelogin, Jumpcloud, and Ping Identity.</td></tr></tbody></table>

​

***

### Configure user authentication <a href="#configure-user-authentication" id="configure-user-authentication"></a>

Authentication can be completed with an Identity and Access Management IAM user or an IAM role. To grant a user access to an EKS cluster, the IAM user or IAM role must be mapped with a specific user identifier, such as an email address.Apono supports this mapping with an IAM role through AWS SSO or SAML federation from any identity provider (IdP).​

#### Create a new policy

Follow these steps to create a new policy:

1. Under **Access management** on the [**Identity and Access Management (IAM)**](http://console.aws.amazon.com/iam/home) page in AWS, click **Policies > Create policy**. The **Specify permission** page appears.
2. Click **JSON**.
3. Replace the default policy with the following policy. Be sure to replace the placeholder.

   ```json
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "eks:DescribeCluster",
               "Resource": "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*"
           }
       ]
   }
   ```

   <table><thead><tr><th width="218">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><strong>&#x3C;AWS_ACCOUNT_ID></strong></td><td>AWS account ID where the EKS is hosted</td></tr></tbody></table>
4. Click **Next**. The **Review and create** page appears.
5. Enter a **Policy name**. This name is used to identify this policy.
6. Click **Create policy**.

​

#### Create the IAM role

Follow these steps to create the IAM role:

1. Under **Access management** on the [**Identity and Access Management (IAM)**](http://console.aws.amazon.com/iam/home) page in AWS, click **Roles > Create role**. The **Select trusted entity** page appears.
2. Under **Trusted entity type**, select **Custom trust policy**.
3. Under **Custom trust policy**, replace the default policy with one of the following trust policies. Be sure to replace the placeholders.

{% tabs %}
{% tab title="AWS SSO" %}
{% code overflow="wrap" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "sts:RoleSessionName": "${SAML:sub}"
                },
                "ArnLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*",
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_*"
                    ]
                }
            }
        }
    ]
}
```

{% endcode %}
{% endtab %}

{% tab title="SAML" %}
{% code overflow="wrap" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:saml-provider/<SAML_PROVIDER>"
            },
            "Action": "sts:AssumeRoleWithSAML",
            "Condition": {
                "StringEquals": {
                    "SAML:aud": "https://signin.aws.amazon.com/saml"
                }
            }
        }
    ]
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

<table><thead><tr><th width="219">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><strong>&#x3C;AWS_ACCOUNT_ID></strong></td><td>AWS account ID where the EKS is hosted</td></tr><tr><td><strong>&#x3C;SAML_PROVIDER></strong></td><td>Identity provider name</td></tr></tbody></table>

4. Click **Next**. The **Add permissions** page appears.
5. Under **Permissions policies**, select the newly created policy.
6. Click **Next**. The **Name, review, and create** page appears.
7. For the **Role name**, enter *apono-k8s-access*.
8. For the **Description**, enter *required for k8s access managed by Apono*.
9. Click **Create role.**

{% hint style="info" %}
If an **Overly permission trust policy** popup window appears, click **Continue**.
{% endhint %}

#### Authenticate the EKS cluster

Now that the IAM role has been created, you must authenticate the EKS cluster with the **ConfigMap** or **EKS API**.

{% tabs %}
{% tab title="ConfigMap" %}
{% hint style="success" %}
Read [Apply the `aws-auth ConfigMap` to your cluster](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html#aws-auth-configmap) to learn more about editing the `aws-auth ConfigMap`.
{% endhint %}

Follow these steps to authenticate the cluster:

1. Log into the EKS cluster with a user account that has the cluster admin permission.
2. Edit the `aws-auth ConfigMap` to include the following `mapRoles` entry. Be sure to replace the placeholder.

   ```yaml
   - rolearn: arn:aws:iam::<AWS_ACCOUNT_ID>:role/apono-k8s-access
     username: "{{SessionNameRaw}}"
   ```

   <table><thead><tr><th width="215">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><strong>&#x3C;AWS_ACCOUNT_ID></strong></td><td>AWS account ID where the EKS is hosted</td></tr></tbody></table>

{% endtab %}

{% tab title="EKS API" %}
Follow these steps to authenticate the cluster:

1. [Change the authentication mode](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html#setting-up-access-entries) to **EKS API**.
2. [Create the access entry](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html#creating-access-entries):
   * For the **IAM principal**, enter *arn:aws:iam::\<AWS\_ACCOUNT\_ID>:role/apono-k8s-access*.
   * For the **Username** use `apono:{{SessionName}}`.
   * Choose **Cluster** as the access scope.
     {% endtab %}
     {% endtabs %}

Now, you can [integrate with EKS](#integrate-with-elastic-kubernetes-service-eks).

***

### Integrate with Elastic Kubernetes Service (EKS)

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-c36a010571d1d18415494c3d6b228db6c290f767%2Fintegrate-eks.png?alt=media" alt="" width="563"><figcaption><p>Elastice Kubernetes Service (EKS) tile</p></figcaption></figure>

{% hint style="success" %}
You can also use the steps below to integrate with Apono using Terraform.

In step **11**, instead of clicking **Confirm**, follow the **Are you integrating with Apono using Terraform?** guidance.
{% endhint %}

Follow these steps to complete the integration:

1. On the [**Catalog**](https://app.apono.io/catalog?search=EKS) tab, click **Elastic Kubernetes Service (EKS)**. The **Connect Integration** page appears.
2. Under **Discovery**, click one or more resource types to sync with Apono.

{% hint style="info" %}
Apono automatically discovers and syncs all the instances in the environment. After syncing, you can manage access flows to these resources.
{% endhint %}

3. Click **Next**. The **Apono connector** section appears.
4. From the dropdown menu, select a connector.

{% hint style="info" %}
If the desired connector is not listed, click **+ Add new connector** and follow the instructions for creating an [Apono Connector for Kubernetes](https://docs.apono.io/docs/kubernetes-environment/apono-connector-for-kubernetes) on an EKS cluster.
{% endhint %}

5. Click **Next**. The **Integration Config** section expands.
6. Define the **Integration Config** settings.

{% hint style="info" %}
When the Apono connector is installed on the EKS cluster, you do not need to enter values for the other optional fields.
{% endhint %}

<table><thead><tr><th width="220">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Integration Name</strong></td><td>Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow</td></tr><tr><td><strong>Server URL</strong></td><td>(Optional) URL of the Kubernetes API server used to interact with the Kubernetes cluster</td></tr><tr><td><strong>Certification Authority</strong></td><td>(Optional) Certificate that ensures that the Kubernetes API server is trusted and authentic<br><br>Leave this field empty if you want to connect the cluster where the connector is deployed.</td></tr><tr><td><strong>EKS Cluster Name</strong></td><td>Unique name of the cluster to integrate</td></tr><tr><td><strong>AWS Role Name</strong></td><td>(Optional) Role defined for the connector</td></tr><tr><td><strong>Region</strong></td><td>(Optional) Location where the AWS Elastic Kubernetes cluster is deployed</td></tr></tbody></table>

7. Click **Next**. The **Secret Store** section expands.

{% hint style="info" %}
When the Apono connector is installed on the EKS cluster, you do not need to provide a secret.
{% endhint %}

8. (Optional) [Associate the secret or credentials](https://docs.apono.io/docs/connectors-and-secrets/apono-integration-secret).
9. Click **Next**. The **Get more with Apono** section expands.
10. Define the **Get more with Apono** settings.

    <table><thead><tr><th width="183">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Credential Rotation</strong></td><td>(Optional) Number of days after which the database credentials must be rotated<br><br>Learn more about the <a href="../../architecture-and-security/credentials-rotation-policy">Credentials Rotation Policy</a>.</td></tr><tr><td><strong>User cleanup after access is revoked (in days)</strong></td><td><p>(Optional) Defines the number of days after access has been revoked that the user should be deleted</p><p><br>Learn more about <a href="../../architecture-and-security/periodic-user-cleanup-and-deletion">Periodic User Cleanup &#x26; Deletion</a>.</p></td></tr><tr><td><strong>Custom Access Details</strong></td><td>(Optional) Instructions explaining how to access this integration's resources<br><br>Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to <strong>400 characters</strong>.<br><br>To view the message as it appears to end users, click <strong>Preview</strong>.</td></tr><tr><td><strong>Integration Owner</strong></td><td><p>(Optional) Fallback approver if no <a href="../../access-flows/dynamic-access-management/resource-and-integration-owners">resource owner</a> is found<br><br>Follow these steps to define one or several integration owners:</p><ol><li>From the <strong>Attribute</strong> dropdown menu, select <strong>User</strong> or <strong>Group</strong> under the relevant identity provider (IdP) platform.</li><li>From the <strong>Value</strong> dropdown menu, select one or multiple users or groups.</li></ol><p><br><strong>NOTE</strong>: When <strong>Resource Owner</strong> is defined, an <strong>Integration Owner</strong> must be defined.</p></td></tr><tr><td><strong>Resource Owner</strong></td><td><p>(Optional) Group or role responsible for managing access approvals or rejections for the resource<br><br>Follow these steps to define one or several <a href="../../access-flows/dynamic-access-management/resource-and-integration-owners">resource owners</a>:</p><ol><li>Enter a <strong>Key name</strong>. This value is the name of the tag created in your cloud environment.</li><li>From the <strong>Attribute</strong> dropdown menu, select an attribute under the IdP platform to which the key name is associated.<br><br>Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.</li></ol><p><br><strong>NOTE</strong>: When this setting is defined, an <strong>Integration Owner</strong> must also be defined.</p></td></tr></tbody></table>
11. Click **Confirm**.

<details>

<summary>💡Are you integrating with Apono using Terraform?</summary>

If you want to integrate with Apono using Terraform, follow these steps instead of clicking **Confirm**:

1. At the top of the screen, click **View as Code**. A modal appears with the completed Terraform configuration code.
2. Click to copy the code.
3. Make any additional edits.
4. Deploy the code in your Terraform.

Refer to [Integration Config Metadata](https://docs.apono.io/metadata-for-integration-config/integration-metadata/aws-eks) for more details about the schema definition.

</details>

Now that you have completed this integration, you can [create access flows](https://docs.apono.io/docs/access-flows/access-flows) that grant permission to your Elastic Kubernetes Service cluster.

***

### Log in to EKS with Apono access details

After a user gains access to an EKS resource, the user must authenticate with the cluster. The user must assume the [`apono-k8s-access` role](#create-the-iam-role).

The following table shows two approaches to assume this role.

<table><thead><tr><th width="217">Approach</th><th>Details</th></tr></thead><tbody><tr><td><strong>AWS CLI</strong></td><td><p>In the AWS CLI, run the <code>aws sts assume-role</code> command. Be sure to replace the placeholders.<br></p><pre data-overflow="wrap"><code>aws sts assume-role \
  --role-arn arn:aws:iam::&#x3C;ACCOUNT_ID>:role/apono-k8s-access \
  --role-session-name &#x3C;EMAIL> \
  --duration-seconds 3600
</code></pre></td></tr><tr><td><strong>Config File</strong></td><td><p>Edit <strong>~/.aws/config</strong> to contain the following profile. Be sure to replace the placeholders.<br></p><pre data-overflow="wrap"><code>[profile apono-k8s-access]
role_arn = arn:aws:iam::&#x3C;ACCOUNT_ID>:role/apono-k8s-access
role_session_name = &#x3C;EMAIL>
source_profile = default
</code></pre></td></tr></tbody></table>

<table><thead><tr><th width="218">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><strong>&#x3C;AWS_ACCOUNT_ID></strong></td><td>AWS account ID where the EKS is hosted</td></tr><tr><td><strong>&#x3C;EMAIL></strong></td><td>User email listed in the IdP</td></tr></tbody></table>