AWS IAM Authenticator

AWS IAM Authenticator lets people and automation use their AWS identity when connecting to the Kubernetes API. That can reduce the need to distribute a separate set of cluster login credentials to a team already using AWS Identity and Access Management. It establishes who a caller is; Kubernetes permissions still determine what that caller may do. It does not give application containers permission to use AWS services.

Deployment and operating notes

This historical entry points to AWS IAM Authenticator, the Kubernetes SIG project that authenticates Kubernetes API clients using AWS IAM credentials. The old stable chart is not the current installation authority. A self-managed API server’s webhook configuration and the managed EKS authentication service are different operating responsibilities.

For EKS, assess the cluster’s authentication mode and access entries before copying old aws-auth or authenticator instructions. Keep a tested administrator recovery path while changing principal mappings; successful IAM authentication does not by itself grant Kubernetes authorization. Workload access to AWS services through Pod Identity or IRSA is a separate problem and does not replace human or automation access to the Kubernetes API. On self-managed clusters, inspect webhook trust, cluster identity, token validation and mapping configuration against the upstream README. Verify both an allowed role and a denied role after changes, and retain the previous access configuration until an independent administrator can confirm recovery.