Use AWS EKS SSO with K8Studio

Confirm IAM Identity Center is enabled

Open IAM Identity Center and confirm the start URL, Identity Center region, AWS account ID, and user or group that will connect to EKS.

aws sso-admin list-instances --region us-east-1 --profile cloudops

Create a permission set

Create a permission set such as K8StudioEKSExec. The AWS side needs enough access to describe the cluster and call STS; Kubernetes permissions come from EKS access entries.

aws sso-admin create-permission-set --name K8StudioEKSExec --instance-arn <instance-arn>

Assign the user or group to the AWS account

Assign the Identity Center user or group to the AWS account with the permission set. AWS creates an AWSReservedSSO IAM role behind the scenes.

aws sso-admin create-account-assignment --instance-arn <instance-arn> --target-id <account-id> --permission-set-arn <permission-set-arn>

Configure the local SSO profile

Create a local AWS CLI profile that points to the SSO start URL, region, account ID, and permission set role name.

aws configure sso --profile k8studio-sso

Login with AWS SSO

Run the login once. AWS opens a browser flow and stores a short-lived SSO token in the local AWS cache.

aws sso login --profile k8studio-sso

Add the SSO role to EKS

Find the AWSReservedSSO role ARN and create an EKS access entry for it. Attach the EKS access policy that matches what K8Studio should be allowed to do.

aws eks create-access-entry \
  --cluster-name k8studio-auth-eks \
  --principal-arn <sso-role-arn>

Generate the kubeconfig

Generate or edit the kubeconfig so the user uses exec authentication and AWS_PROFILE points to the SSO profile.

aws eks update-kubeconfig --name k8studio-auth-eks --region us-east-1 --profile k8studio-sso

Verify with kubectl

Before opening K8Studio, confirm that kubectl can connect using the same context and profile.

kubectl --context k8studio-sso@k8studio-auth-eks.us-east-1.eksctl.io get nodes

Add the kubeconfig to K8Studio

Open K8Studio, add the kubeconfig file, select the SSO-backed EKS context, and connect. K8Studio runs aws eks get-token through the kubeconfig exec plugin.

Test the logged-out state

Logout from AWS SSO and reconnect. K8Studio should detect the missing SSO token and show a user-clicked Login with AWS SSO action.

aws sso logout --profile k8studio-sso