Amazon EKS Eks Access Entries API
The Eks Access Entries API from Amazon EKS — 2 operation(s) for eks access entries.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/amazon-eks:amazon-eks-access-entries-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.1.0
info:
title: Amazon Elastic Kubernetes Service Access Entries API
version: '2017-11-01'
description: Generated from AWS's published Smithy model for Amazon Elastic Kubernetes Service. 5 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://eks.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
paths:
/clusters/{clusterName}/access-entries:
post:
operationId: CreateAccessEntry
summary: Create Access Entry
description: 'Creates an access entry. An access entry allows an IAM principal to access your cluster. Access entries
can replace the need to maintain entries in the aws-auth ConfigMap for authentication. You have the following options
for authorizing an IAM principal to access Kubernetes objects on your cluster: Kubernetes role-based access control
(RBAC), Amazon EKS, or both. Kubernetes RBAC authorization requires you to create and manage Kubernetes Role, ClusterRole,
RoleBinding, and ClusterRoleBinding objects, in addition to managing access entries. If you use Amazon EKS authorization
exclusively, you don''t need to create and manage Kubernetes Role, ClusterRole, RoleBinding, and ClusterRoleBinding
objects. For more information about access entries, see Access entries in the Amazon EKS User Guide.'
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAccessEntryResponse'
'400':
description: InvalidParameterException; InvalidRequestException; ResourceLimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidParameterException'
'409':
description: ResourceInUseException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceInUseException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'500':
description: ServerException
content:
application/json:
schema:
$ref: '#/components/schemas/ServerException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAccessEntryRequest'
tags:
- Access Entries
get:
operationId: ListAccessEntries
summary: List Access Entries
description: Lists the access entries for your cluster.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/ListAccessEntriesResponse'
'400':
description: InvalidParameterException; InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidParameterException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'500':
description: ServerException
content:
application/json:
schema:
$ref: '#/components/schemas/ServerException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ListAccessEntriesRequest'
tags:
- Access Entries
/clusters/{clusterName}/access-entries/{principalArn}:
delete:
operationId: DeleteAccessEntry
summary: Delete Access Entry
description: Deletes an access entry. Deleting an access entry of a type other than Standard can cause your cluster
to function improperly. If you delete an access entry in error, you can recreate it.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeleteAccessEntryResponse'
'400':
description: InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'500':
description: ServerException
content:
application/json:
schema:
$ref: '#/components/schemas/ServerException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DeleteAccessEntryRequest'
tags:
- Access Entries
get:
operationId: DescribeAccessEntry
summary: Describe Access Entry
description: Describes an access entry.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DescribeAccessEntryResponse'
'400':
description: InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'500':
description: ServerException
content:
application/json:
schema:
$ref: '#/components/schemas/ServerException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DescribeAccessEntryRequest'
tags:
- Access Entries
post:
operationId: UpdateAccessEntry
summary: Update Access Entry
description: Updates an access entry.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateAccessEntryResponse'
'400':
description: InvalidParameterException; InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidParameterException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'500':
description: ServerException
content:
application/json:
schema:
$ref: '#/components/schemas/ServerException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateAccessEntryRequest'
tags:
- Access Entries
components:
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: eks
schemas:
AccessEntry:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
principalArn:
type: string
description: The ARN of the IAM principal for the access entry. If you ever delete the IAM principal with this ARN,
the access entry isn't automatically deleted. We recommend that you delete the access entry with an ARN for an
IAM principal that you delete. If you don't delete the access entry and ever recreate the IAM principal, even
if it has the same ARN, the access entry won't work. This is because even though the ARN is the same for the recreated
IAM principal, the roleID or userID (you can see this with the Security Token Service GetCallerIdentity API) is
different for the recreated IAM principal tha
kubernetesGroups:
type: array
items:
type: string
description: A name that you've specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes
authorizes the principalARN access to cluster objects.
accessEntryArn:
type: string
description: The ARN of the access entry.
createdAt:
type: string
format: date-time
description: The Unix epoch timestamp at object creation.
modifiedAt:
type: string
format: date-time
description: The Unix epoch timestamp for the last modification to the object.
tags:
type: object
additionalProperties:
type: string
description: Metadata that assists with categorization and organization. Each tag consists of a key and an optional
value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
username:
type: string
description: The name of a user that can authenticate to your cluster.
type:
type: string
description: The type of the access entry.
CreateAccessEntryRequest:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
principalArn:
type: string
description: The ARN of the IAM principal for the AccessEntry. You can specify one ARN for each access entry. You
can't specify the same ARN in more than one access entry. This value can't be changed after access entry creation.
The valid principals differ depending on the type of the access entry in the type field. For STANDARD access entries,
you can use every IAM principal type. For nodes (EC2 (for EKS Auto Mode), EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX,
and HYBRID_LINUX), the only valid ARN is IAM roles. You can't use the STS session principal type with access entries
because this is a temporary principa
kubernetesGroups:
type: array
items:
type: string
description: 'The value for name that you''ve specified for kind: Group as a subject in a Kubernetes RoleBinding
or ClusterRoleBinding object. Amazon EKS doesn''t confirm that the value for name exists in any bindings on your
cluster. You can specify one or more names. Kubernetes authorizes the principalArn of the access entry to access
any cluster objects that you''ve specified in a Kubernetes Role or ClusterRole object that is also specified in
a binding''s roleRef. For more information about creating Kubernetes RoleBinding, ClusterRoleBinding, Role, or
ClusterRole objects, see Using RBAC Authorization in the'
tags:
type: object
additionalProperties:
type: string
description: Metadata that assists with categorization and organization. Each tag consists of a key and an optional
value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
clientRequestToken:
type: string
description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
username:
type: string
description: The username to authenticate to Kubernetes with. We recommend not specifying a username and letting
Amazon EKS specify it for you. For more information about the value Amazon EKS specifies for you, or constraints
before specifying your own username, see Creating access entries in the Amazon EKS User Guide.
type:
type: string
description: The type of the new access entry. Valid values are STANDARD, FARGATE_LINUX, EC2_LINUX, EC2_WINDOWS,
EC2 (for EKS Auto Mode), HYBRID_LINUX, and HYPERPOD_LINUX. If the principalArn is for an IAM role that's used
for self-managed Amazon EC2 nodes, specify EC2_LINUX or EC2_WINDOWS. Amazon EKS grants the necessary permissions
to the node for you. If the principalArn is for any other purpose, specify STANDARD. If you don't specify a value,
Amazon EKS sets the value to STANDARD. If you have the access mode of the cluster set to API_AND_CONFIG_MAP, it's
unnecessary to create access entries for IAM rol
required:
- clusterName
- principalArn
CreateAccessEntryResponse:
type: object
properties:
accessEntry:
$ref: '#/components/schemas/AccessEntry'
DeleteAccessEntryRequest:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
principalArn:
type: string
description: The ARN of the IAM principal for the AccessEntry.
required:
- clusterName
- principalArn
DeleteAccessEntryResponse:
type: object
properties: {}
DescribeAccessEntryRequest:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
principalArn:
type: string
description: The ARN of the IAM principal for the AccessEntry.
required:
- clusterName
- principalArn
DescribeAccessEntryResponse:
type: object
properties:
accessEntry:
$ref: '#/components/schemas/AccessEntry'
InvalidParameterException:
type: object
properties:
clusterName:
type: string
description: The Amazon EKS cluster associated with the exception.
nodegroupName:
type: string
description: The Amazon EKS managed node group associated with the exception.
fargateProfileName:
type: string
description: The Fargate profile associated with the exception.
addonName:
type: string
description: The specified parameter for the add-on name is invalid. Review the available parameters for the API
request
subscriptionId:
type: string
description: The Amazon EKS subscription ID with the exception.
message:
type: string
description: The specified parameter is invalid. Review the available parameters for the API request.
InvalidRequestException:
type: object
properties:
clusterName:
type: string
description: The Amazon EKS cluster associated with the exception.
nodegroupName:
type: string
description: The Amazon EKS managed node group associated with the exception.
addonName:
type: string
description: The request is invalid given the state of the add-on name. Check the state of the cluster and the associated
operations.
subscriptionId:
type: string
description: The Amazon EKS subscription ID with the exception.
message:
type: string
description: The Amazon EKS add-on name associated with the exception.
ListAccessEntriesRequest:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
associatedPolicyArn:
type: string
description: The ARN of an AccessPolicy. When you specify an access policy ARN, only the access entries associated
to that access policy are returned. For a list of available policy ARNs, use ListAccessPolicies.
maxResults:
type: integer
description: The maximum number of results, returned in paginated output. You receive maxResults in a single page,
along with a nextToken response element. You can see the remaining results of the initial request by sending another
request with the returned nextToken value. This value can be between 1 and 100. If you don't use this parameter,
100 results and a nextToken value, if applicable, are returned.
nextToken:
type: string
description: The nextToken value returned from a previous paginated request, where maxResults was used and the results
exceeded the value of that parameter. Pagination continues from the end of the previous results that returned
the nextToken value. This value is null when there are no more results to return. This token should be treated
as an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic
purposes.
required:
- clusterName
ListAccessEntriesResponse:
type: object
properties:
accessEntries:
type: array
items:
type: string
description: The list of access entries that exist for the cluster.
nextToken:
type: string
description: The nextToken value returned from a previous paginated request, where maxResults was used and the results
exceeded the value of that parameter. Pagination continues from the end of the previous results that returned
the nextToken value. This value is null when there are no more results to return. This token should be treated
as an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic
purposes.
ResourceInUseException:
type: object
properties:
clusterName:
type: string
description: The Amazon EKS cluster associated with the exception.
nodegroupName:
type: string
description: The Amazon EKS managed node group associated with the exception.
addonName:
type: string
description: The specified add-on name is in use.
message:
type: string
description: The Amazon EKS message associated with the exception.
ResourceNotFoundException:
type: object
properties:
clusterName:
type: string
description: The Amazon EKS cluster associated with the exception.
nodegroupName:
type: string
description: The Amazon EKS managed node group associated with the exception.
fargateProfileName:
type: string
description: The Fargate profile associated with the exception.
addonName:
type: string
description: The Amazon EKS add-on name associated with the exception.
subscriptionId:
type: string
description: The Amazon EKS subscription ID with the exception.
message:
type: string
description: The Amazon EKS message associated with the exception.
ServerException:
type: object
properties:
clusterName:
type: string
description: The Amazon EKS cluster associated with the exception.
nodegroupName:
type: string
description: The Amazon EKS managed node group associated with the exception.
addonName:
type: string
description: The Amazon EKS add-on name associated with the exception.
subscriptionId:
type: string
description: The Amazon EKS subscription ID with the exception.
message:
type: string
description: These errors are usually caused by a server-side issue.
UpdateAccessEntryRequest:
type: object
properties:
clusterName:
type: string
description: The name of your cluster.
principalArn:
type: string
description: The ARN of the IAM principal for the AccessEntry.
kubernetesGroups:
type: array
items:
type: string
description: 'The value for name that you''ve specified for kind: Group as a subject in a Kubernetes RoleBinding
or ClusterRoleBinding object. Amazon EKS doesn''t confirm that the value for name exists in any bindings on your
cluster. You can specify one or more names. Kubernetes authorizes the principalArn of the access entry to access
any cluster objects that you''ve specified in a Kubernetes Role or ClusterRole object that is also specified in
a binding''s roleRef. For more information about creating Kubernetes RoleBinding, ClusterRoleBinding, Role, or
ClusterRole objects, see Using RBAC Authorization in the'
clientRequestToken:
type: string
description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
username:
type: string
description: The username to authenticate to Kubernetes with. We recommend not specifying a username and letting
Amazon EKS specify it for you. For more information about the value Amazon EKS specifies for you, or constraints
before specifying your own username, see Creating access entries in the Amazon EKS User Guide.
required:
- clusterName
- principalArn
UpdateAccessEntryResponse:
type: object
properties:
accessEntry:
$ref: '#/components/schemas/AccessEntry'
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/eks/service/2017-11-01/eks-2017-11-01.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)