AWS-EKS

The AWS EKS integration allows for the management and operation of Amazon Elastic Kubernetes Service (EKS) clusters.

Cloud Services · AWS - EKS

Details

IDAWS-EKS
ProviderAmazon
CategoryCloud Services
From Version6.9.0
Docker Imagedemisto/boto3py3:1.0.0.10221838
Supported ModulesAgentix XSIAM

README

The AWS EKS integration allows for the management and operation of Amazon Elastic Kubernetes Service (EKS) clusters.
This integration was integrated and tested with version 1.29 of AWS-EKS.

Configure AWS-EKS in Cortex

Parameter Description Required
AWS Default Region AWS Default Region True
Access Key   True
Secret Key   True
Timeout The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used. False
Retries The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time. False
Trust any certificate (not secure) Trust any certificate (not secure) False
Use system proxy settings Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-eks-list-clusters

Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Amazon Web Services Region.

Base Command

aws-eks-list-clusters

Input

Argument Name Description Required
limit The maximum number of clusters to return. Default is 50. Optional
next_token The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter. Optional
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.Cluster.ClustersNames List A list of all of the clusters for your account in the specified Amazon Web Services Region.
AWS.EKS.Cluster.NextToken List The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter.

Command example


#### Context Example

```json
{
    "AWS": {
        "EKS": {
            "Cluster": {
                "ClustersNames": [
                    "cluster_name1",
                    "cluster_name2"
                ],
                "NextToken": null
            }
        }
    }
}

Human Readable Output

The list of clusters

Clusters Names
cluster_name1
cluster_name2

aws-eks-update-cluster-config

Updates an Amazon EKS cluster configuration. Only one type of update is allowed. Potentially harmful: once the authentication mode is updated to ‘API’ it is irreversible.

Base Command

aws-eks-update-cluster-config

Input

Argument Name Description Required
cluster_name The name of the Amazon EKS cluster to update. Required
resources_vpc_config A JSON representation of the VPC configuration used by the cluster control plane. An example: “{‘subnetIds’: [‘string’], ‘securityGroupIds’: [‘string’], ‘endpointPublicAccess’: True, ‘endpointPrivateAccess’: True, ‘publicAccessCidrs’: [‘string’]}”. Optional
logging A JSON representation of the logging configuration for the cluster. An example: “{‘clusterLogging’: [{‘types’: [‘api’, ‘audit’, ‘authenticator’, ‘controllerManager’, ‘scheduler’], ‘enabled’: true}]}”. Optional
authentication_mode Whether to update the authentication mode to ‘API_AND_CONFIG_MAP’ or not. Possible values are: true, false. Optional
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.UpdateCluster.clusterName String The name of the cluster.
AWS.EKS.UpdateCluster.id Integer The ID of the update.
AWS.EKS.UpdateCluster.status String The status of the update.
AWS.EKS.UpdateCluster.type String The type of the update.
AWS.EKS.UpdateCluster.params Object The parameters of the update.
AWS.EKS.UpdateCluster.createdAt String The creation date of the object.
AWS.EKS.UpdateCluster.errors Object Any errors associated with a failed update.

Command example

!aws-eks-update-cluster-config cluster_name=CLUSTER_NAME logging="{'clusterLogging': [{'types': ['api', 'authenticator', 'audit'], 'enabled': false}]}"

Context Example

{
    "AWS": {
        "EKS": {
            "UpdateCluster": {
                "createdAt": "2024-02-26 09:38:11.578000+00:00",
                "errors": [],
                "id": "11111111-1111-1111-1111-111111111111",
                "name": "CLUSTER_NAME",
                "params": [
                    {
                        "type": "ClusterLogging",
                        "value": "{\"clusterLogging\":[{\"types\":[\"api\",\"audit\",\"authenticator\"],\"enabled\":false}]}"
                    }
                ],
                "status": "InProgress",
                "type": "LoggingUpdate"
            }
        }
    }
}

Human Readable Output

Updated Cluster Config Information

Cluster Name ID Status Type Params
CLUSTER_NAME 11111111-1111-1111-1111-111111111111 InProgress LoggingUpdate {‘type’: ‘ClusterLogging’, ‘value’: ‘{“clusterLogging”:[{“types”:[“api”,”audit”,”authenticator”],”enabled”:false}]}’}

aws-eks-describe-cluster

Describes an Amazon EKS cluster.

Base Command

aws-eks-describe-cluster

Input

Argument Name Description Required
cluster_name The name of the cluster to describe. Required
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.DescribeCluster.name String The name of your cluster.
AWS.EKS.DescribeCluster.arn String The Amazon Resource Name (ARN) of the cluster.
AWS.EKS.DescribeCluster.createdAt String The creation date of the object.
AWS.EKS.DescribeCluster.version String The Kubernetes server version for the cluster.
AWS.EKS.DescribeCluster.endpoint String The endpoint for your Kubernetes API server.
AWS.EKS.DescribeCluster.roleArn String The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf.
AWS.EKS.DescribeCluster.resourcesVpcConfig.subnetIds List The subnets associated with your cluster.
AWS.EKS.DescribeCluster.resourcesVpcConfig.securityGroupIds List The security groups associated with the cross-account elastic network interfaces that are used to allow communication between your nodes and the Kubernetes control plane.
AWS.EKS.DescribeCluster.resourcesVpcConfig.clusterSecurityGroupId String The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.
AWS.EKS.DescribeCluster.resourcesVpcConfig.vpcId String The VPC associated with your cluster.
AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPublicAccess Boolean Whether the public API server endpoint is enabled.
AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPrivateAccess Boolean This parameter indicates whether the Amazon EKS private API server endpoint is enabled.
AWS.EKS.DescribeCluster.resourcesVpcConfig.publicAccessCidrs List The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint.
AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv4Cidr String The CIDR block that Kubernetes Pod and Service object IP addresses are assigned from.
AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv6Cidr String The CIDR block that Kubernetes Pod and Service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified ipv6 for ipFamily when you created the cluster.
AWS.EKS.DescribeCluster.kubernetesNetworkConfig.ipFamily String The IP family used to assign Kubernetes Pod and Service objects IP addresses.
AWS.EKS.DescribeCluster.logging.clusterLogging Object The cluster control plane logging configuration for your cluster.
AWS.EKS.DescribeCluster.identity Object The identity provider information for the cluster.
AWS.EKS.DescribeCluster.status String The current status of the cluster.
AWS.EKS.DescribeCluster.certificateAuthority.data String The Base64-encoded certificate data required to communicate with your cluster.
AWS.EKS.DescribeCluster.clientRequestToken String A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
AWS.EKS.DescribeCluster.platformVersion String The platform version of your Amazon EKS cluster.
AWS.EKS.DescribeCluster.tags Object A dictionary containing metadata for categorization and organization.
AWS.EKS.DescribeCluster.encryptionConfig.resources List Specifies the resources to be encrypted. The only supported value is secrets.
AWS.EKS.DescribeCluster.encryptionConfig.provider Object Key Management Service (KMS) key.
AWS.EKS.DescribeCluster.connectorConfig.activationId String A unique ID associated with the cluster for registration purposes.
AWS.EKS.DescribeCluster.connectorConfig.activationCode String A unique code associated with the cluster for registration purposes.
AWS.EKS.DescribeCluster.connectorConfig.activationExpiry String The expiration time of the connected cluster.
AWS.EKS.DescribeCluster.connectorConfig.provider String The cluster’s cloud service provider.
AWS.EKS.DescribeCluster.connectorConfig.roleArn String The Amazon Resource Name (ARN) of the role to communicate with services from the connected Kubernetes cluster.
AWS.EKS.DescribeCluster.id String The ID of your local Amazon EKS cluster on an Amazon Web Services Outpost.
AWS.EKS.DescribeCluster.health.issues List An object representing the health issues of your local Amazon EKS cluster on an Amazon Web Services Outpost.
AWS.EKS.DescribeCluster.outpostConfig.outpostArns Object An object representing the configuration of your local Amazon EKS cluster on an Amazon Web Services Outpost.
AWS.EKS.DescribeCluster.outpostConfig.controlPlaneInstanceType String The Amazon EC2 instance type used for the control plane.
AWS.EKS.DescribeCluster.outpostConfig.controlPlanePlacement Object An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an Amazon Web Services Outpost.
AWS.EKS.DescribeCluster.accessConfig.bootstrapClusterCreatorAdminPermissions Boolean Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time.
AWS.EKS.DescribeCluster.accessConfig.authenticationMode String The current authentication mode of the cluster.

Command example

!aws-eks-describe-cluster cluster_name=CLUSTER_NAME

Context Example

{
    "AWS": {
        "EKS": {
            "DescribeCluster": {
                "accessConfig": {
                    "authenticationMode": "API_AND_CONFIG_MAP"
                },
                "arn": "arn",
                "certificateAuthority": {
                    "data": "data_key"
                },
                "createdAt": "2024-02-26 09:38:11.578000+00:00",
                "endpoint": "endpoint",
                "health": {
                    "issues": []
                },
                "identity": {
                    "oidc": {
                        "issuer": "issuer"
                    }
                },
                "kubernetesNetworkConfig": {
                    "ipFamily": "ipv4",
                    "serviceIpv4Cidr": "11.111.1.1/11"
                },
                "logging": {
                    "clusterLogging": [
                        {
                            "enabled": true,
                            "types": [
                                "api",
                                "audit",
                                "authenticator",
                                "controllerManager",
                                "scheduler"
                            ]
                        }
                    ]
                },
                "name": "CLUSTER_NAME",
                "platformVersion": "eks.1",
                "resourcesVpcConfig": {
                    "clusterSecurityGroupId": "sg-id",
                    "endpointPrivateAccess": true,
                    "endpointPublicAccess": true,
                    "publicAccessCidrs": [
                        "111.111.111.111/11"
                    ],
                    "securityGroupIds": [
                        "sg-id"
                    ],
                    "subnetIds": [
                        "subnet-id"
                    ],
                    "vpcId": "vpc-id"
                },
                "roleArn": "roleArn",
                "status": "ACTIVE",
                "tags": {},
                "version": "1.29"
            }
        }
    }
}

Human Readable Output

Describe Cluster Information

Cluster Name Status ARN Created At Version
roleArn ACTIVE roleArn 2024-02-26 09:38:11.578000+00:00 1.29

aws-eks-create-access-entry

Creates an access entry.

Base Command

aws-eks-create-access-entry

Input

Argument Name Description Required
cluster_name The name of the cluster for which to create an access entry. Required
principal_arn ARN of the IAM principal for the AccessEntry. Required
kubernetes_groups A comma-separated list of names for Kubernetes groups in RoleBindings or ClusterRoleBindings. Optional
tags A dictionary containing metadata for categorization and organization. Each tag consists of a key and an optional value. Optional
client_request_token Unique identifier for idempotency. Optional
username Username for Kubernetes authentication. Optional
type The type of access entry to create. Possible values are: Standard, FARGATE_LINUX, EC2_LINUX, EC2_WINDOWS. Default is Standard. Optional
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.CreateAccessEntry.clusterName String The name of the cluster.
AWS.EKS.CreateAccessEntry.principalArn String The ARN of the IAM principal for the access entry.
AWS.EKS.CreateAccessEntry.kubernetesGroups String A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
AWS.EKS.CreateAccessEntry.accessEntryArn String The ARN of the access entry.
AWS.EKS.CreateAccessEntry.createdAt String The creation date of the object.
AWS.EKS.CreateAccessEntry.modifiedAt String The date and time for the last modification to the object.
AWS.EKS.CreateAccessEntry.tags Object A dictionary containing metadata for categorization and organization.
AWS.EKS.CreateAccessEntry.username String The name of a user that can authenticate to the cluster.
AWS.EKS.CreateAccessEntry.type String The type of the access entry.

Command example

!aws-eks-create-access-entry cluster_name=CLUSTER_NAME principal_arn=principal_arn

Context Example

{
    "AWS": {
        "EKS": {
            "CreateAccessEntry": {
                "ResponseMetadata": {
                    "clusterName": "clusterName",
                    "principalArn": "principalArn",
                    "kubernetesGroups": [
                        "kubernetesGroups"
                    ],
                    "accessEntryArn": "accessEntryArn",
                    "createdAt": "2024-02-26 09:38:11.578000+00:00",
                    "modifiedAt": "2024-02-26 09:38:11.578000+00:00",
                    "tags": {
                        "string": "string"
                    },
                    "username": "username",
                    "type": "STANDARD"
                }
            }
        }
    }
}

Human Readable Output

The newly created access entry

Cluster Name Principal Arn Username Type Created At
clusterName principalArn username STANDARD 2024-02-26 09:38:11.578000+00:00

aws-eks-associate-access-policy

Associates an access policy and its scope to an access entry.

Base Command

aws-eks-associate-access-policy

Input

Argument Name Description Required
cluster_name The name of the cluster for which to create an access entry. Required
principal_arn The Amazon Resource Name (ARN) of the IAM user or role for the AccessEntry that you’re associating the access policy to. Required
policy_arn The ARN of the AccessPolicy that you’re associating. Required
type The scope type of an access policy. Possible values are: cluster, namespace. Required
namespaces A comma-separated list of Kubernetes namespaces that an access policy is scoped to. A value is required if you specified namespace for type. Optional
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.AssociatedAccessPolicy.clusterName String The name of your cluster.
AWS.EKS.AssociatedAccessPolicy.principalArn String The ARN of the IAM principal for the AccessEntry.
AWS.EKS.AssociatedAccessPolicy.policyArn String The ARN of the AccessPolicy.
AWS.EKS.AssociatedAccessPolicy.accessScope.type String The scope type of an access policy.
AWS.EKS.AssociatedAccessPolicy.accessScope.namespaces String A Kubernetes namespace that an access policy is scoped to.
AWS.EKS.AssociatedAccessPolicy.associatedAt String The date and time the AccessPolicy was associated with an AccessEntry.
AWS.EKS.AssociatedAccessPolicy.modifiedAt String The date and time for the last modification to the object.

Command example

!aws-eks-associate-access-policy cluster_name=CLUSTER_NAME principal_arn=principal_arn type=cluster

Context Example

{
    "AWS": {
        "EKS": {
            "AssociatedAccessPolicy": {
                "associatedAccessPolicy": {
                    "accessScope": {
                        "namespaces": [],
                        "type": "cluster"
                    },
                    "associatedAt": "2024-02-26 09:38:11.578000+00:00",
                    "modifiedAt": "2024-02-26 09:38:11.578000+00:00",
                    "policyArn": "policyArn"
                },
                "clusterName": "CLUSTER_NAME",
                "principalArn": "principalArn"
            }
        }
    }
}

Human Readable Output

The access policy was associated to the access entry successfully

Cluster Name Principal Arn Policy Arn associate At
clusterName principalArn username 2024-02-26 09:38:11.578000+00:00

aws-eks-update-access-entry

Updates an access entry.

Base Command

aws-eks-update-access-entry

Input

Argument Name Description Required
cluster_name The name of the cluster. Required
principal_arn ARN of the IAM principal for the AccessEntry. Required
kubernetes_groups A comma-separated list of names for Kubernetes groups in RoleBindings or ClusterRoleBindings. Optional
client_request_token Unique identifier for idempotency. Optional
username Username for Kubernetes authentication. Optional
region The AWS Region. If not specified, the configured region will be used. Possible values are: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, eu-west-1, eu-central-1, eu-west-2, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, eu-north-1, eu-west-3. Optional

Context Output

Path Type Description
AWS.EKS.UpdateAccessEntry.clusterName String The name of your cluster.
AWS.EKS.UpdateAccessEntry.principalArn String The ARN of the IAM principal for the access entry.
AWS.EKS.UpdateAccessEntry.kubernetesGroups List A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
AWS.EKS.UpdateAccessEntry.accessEntryArn String The ARN of the access entry.
AWS.EKS.UpdateAccessEntry.createdAt String The creation date of the object.
AWS.EKS.UpdateAccessEntry.modifiedAt String The date and time for the last modification to the object.
AWS.EKS.UpdateAccessEntry.tags Object Metadata that assists with categorization and organization. Each tag consists of a key and an optional value.
AWS.EKS.UpdateAccessEntry.username String The name of a user that can authenticate to your cluster.
AWS.EKS.UpdateAccessEntry.type String The type of the access entry.

Command example

!aws-eks-update-access-entry cluster_name=CLUSTER_NAME principal_arn=principal_arn

Context Example

{
    "AWS": {
        "EKS": {
            "UpdateAccessEntry": {
                "accessEntryArn": "accessEntryArn",
                "clusterName": "CLUSTER_NAME",
                "createdAt": "2024-02-26 09:38:11.578000+00:00",
                "kubernetesGroups": [],
                "modifiedAt": "2024-02-26 09:38:11.578000+00:00",
                "principalArn": "principalArn",
                "tags": {},
                "type": "STANDARD",
                "username": "username"
            }
        }
    }
}

Human Readable Output

The updated access entry

Cluster Name Principal Arn Username Type Modified At
CLUSTER_NAME principal_arn username STANDARD 2024-02-26 09:38:11.578000+00:00

Configuration parameters

  • defaultRegion — AWS Default Region (required)
  • credentials — Access Key (required)
  • timeout — Timeout
  • retries — Retries
  • sts_regional_endpoint — AWS STS Regional Endpoints
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (6)

  • aws-eks-associate-access-policy

    Associates an access policy and its scope to an access entry.

  • aws-eks-create-access-entry

    Creates an access entry.

  • aws-eks-describe-cluster

    Describes an Amazon EKS cluster.

  • aws-eks-list-clusters

    Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Amazon Web Services Region.

  • aws-eks-update-access-entry

    Updates an access entry.

  • aws-eks-update-cluster-config

    Updates an Amazon EKS cluster configuration. Only one type of update is allowed. Potentially harmful: once the authentication mode is updated to 'API' it is irreversible.

Source

AWSEKS.py AWSEKS_test.py AWSEKS.yml AWSEKS_description.md command_examples.txt
Download History Raw 
category: Cloud Services
provider: Amazon
commonfields:
  id: AWS-EKS
  version: -1
configuration:
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  required: true
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: true
- display: Timeout
  name: timeout
  defaultvalue: 60,10
  additionalinfo: The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used.
  type: 0
  required: false
  section: Connect
- display: Retries
  name: retries
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: The AWS EKS integration allows for the management and operation of Amazon Elastic Kubernetes Service (EKS) clusters.
display: AWS-EKS
name: AWS-EKS
script:
  commands:
  - name: aws-eks-list-clusters
    description: Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Amazon Web Services Region.
    arguments:
    - name: limit
      description: The maximum number of clusters to return.
      defaultValue: 50
    - name: next_token
      description: The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter.
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.Cluster.ClustersNames
      description: A list of all of the clusters for your account in the specified Amazon Web Services Region.
      type: List
    - contextPath: AWS.EKS.Cluster.NextToken
      description: The nextToken value returned from a previous paginated request, where maxResults was used and the results exceeded the value of that parameter.
      type: List
  - name: aws-eks-update-cluster-config
    description: "Updates an Amazon EKS cluster configuration. Only one type of update is allowed. Potentially harmful: once the authentication mode is updated to 'API' it is irreversible."
    execution: true
    arguments:
    - name: cluster_name
      description: The name of the Amazon EKS cluster to update.
      required: true
      isArray: false
    - name: resources_vpc_config
      description: "A JSON representation of the VPC configuration used by the cluster control plane. An example: \"{'subnetIds': ['string'], 'securityGroupIds': ['string'], 'endpointPublicAccess': True, 'endpointPrivateAccess': True, 'publicAccessCidrs': ['string']}\"."
      required: false
      isArray: false
    - name: logging
      description: "A JSON representation of the logging configuration for the cluster. An example: \"{'clusterLogging': [{'types': ['api', 'audit', 'authenticator', 'controllerManager', 'scheduler'], 'enabled': true}]}\"."
      required: false
      isArray: false
    - name: authentication_mode
      description: Whether to update the authentication mode to 'API_AND_CONFIG_MAP' or not.
      required: false
      isArray: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.UpdateCluster.clusterName
      description: The name of the cluster.
      type: String
    - contextPath: AWS.EKS.UpdateCluster.id
      description: The ID of the update.
      type: Integer
    - contextPath: AWS.EKS.UpdateCluster.status
      description: The status of the update.
      type: String
    - contextPath: AWS.EKS.UpdateCluster.type
      description: The type of the update.
      type: String
    - contextPath: AWS.EKS.UpdateCluster.params
      description: The parameters of the update.
      type: Object
    - contextPath: AWS.EKS.UpdateCluster.createdAt
      description: The creation date of the object.
      type: String
    - contextPath: AWS.EKS.UpdateCluster.errors
      description: Any errors associated with a failed update.
      type: Object
  - name: aws-eks-describe-cluster
    description: Describes an Amazon EKS cluster.
    arguments:
    - name: cluster_name
      description: The name of the cluster to describe.
      required: true
      isArray: false
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.DescribeCluster.name
      description: The name of your cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.arn
      description: The Amazon Resource Name (ARN) of the cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.createdAt
      description: The creation date of the object.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.version
      description: The Kubernetes server version for the cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.endpoint
      description: The endpoint for your Kubernetes API server.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.roleArn
      description: The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.subnetIds
      description: The subnets associated with your cluster.
      type: List
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.securityGroupIds
      description: The security groups associated with the cross-account elastic network interfaces that are used to allow communication between your nodes and the Kubernetes control plane.
      type: List
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.clusterSecurityGroupId
      description: The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.vpcId
      description: The VPC associated with your cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPublicAccess
      description: Whether the public API server endpoint is enabled.
      type: Boolean
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPrivateAccess
      description: This parameter indicates whether the Amazon EKS private API server endpoint is enabled.
      type: Boolean
    - contextPath: AWS.EKS.DescribeCluster.resourcesVpcConfig.publicAccessCidrs
      description: The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint.
      type: List
    - contextPath: AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv4Cidr
      description: The CIDR block that Kubernetes Pod and Service object IP addresses are assigned from.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv6Cidr
      description: The CIDR block that Kubernetes Pod and Service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified ipv6 for ipFamily when you created the cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.kubernetesNetworkConfig.ipFamily
      description: The IP family used to assign Kubernetes Pod and Service objects IP addresses.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.logging.clusterLogging
      description: The cluster control plane logging configuration for your cluster.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.identity
      description: The identity provider information for the cluster.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.status
      description: The current status of the cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.certificateAuthority.data
      description: The Base64-encoded certificate data required to communicate with your cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.clientRequestToken
      description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.platformVersion
      description: The platform version of your Amazon EKS cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.tags
      description: A dictionary containing metadata for categorization and organization.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.encryptionConfig.resources
      description: Specifies the resources to be encrypted. The only supported value is secrets.
      type: List
    - contextPath: AWS.EKS.DescribeCluster.encryptionConfig.provider
      description: Key Management Service (KMS) key.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.connectorConfig.activationId
      description: A unique ID associated with the cluster for registration purposes.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.connectorConfig.activationCode
      description: A unique code associated with the cluster for registration purposes.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.connectorConfig.activationExpiry
      description: The expiration time of the connected cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.connectorConfig.provider
      description: The cluster’s cloud service provider.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.connectorConfig.roleArn
      description: The Amazon Resource Name (ARN) of the role to communicate with services from the connected Kubernetes cluster.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.id
      description: The ID of your local Amazon EKS cluster on an Amazon Web Services Outpost.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.health.issues
      description: An object representing the health issues of your local Amazon EKS cluster on an Amazon Web Services Outpost.
      type: List
    - contextPath: AWS.EKS.DescribeCluster.outpostConfig.outpostArns
      description: An object representing the configuration of your local Amazon EKS cluster on an Amazon Web Services Outpost.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.outpostConfig.controlPlaneInstanceType
      description: The Amazon EC2 instance type used for the control plane.
      type: String
    - contextPath: AWS.EKS.DescribeCluster.outpostConfig.controlPlanePlacement
      description: An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an Amazon Web Services Outpost.
      type: Object
    - contextPath: AWS.EKS.DescribeCluster.accessConfig.bootstrapClusterCreatorAdminPermissions
      description: Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time.
      type: Boolean
    - contextPath: AWS.EKS.DescribeCluster.accessConfig.authenticationMode
      description: The current authentication mode of the cluster.
      type: String
  - name: aws-eks-create-access-entry
    description: Creates an access entry.
    arguments:
    - name: cluster_name
      description: The name of the cluster for which to create an access entry.
      required: true
      isArray: false
    - name: principal_arn
      description: ARN of the IAM principal for the AccessEntry.
      required: true
      isArray: false
    - name: kubernetes_groups
      description: A comma-separated list of names for Kubernetes groups in RoleBindings or ClusterRoleBindings.
      required: false
      isArray: false
    - name: tags
      description: A dictionary containing metadata for categorization and organization. Each tag consists of a key and an optional value.
      required: false
      isArray: false
    - name: client_request_token
      description: Unique identifier for idempotency.
      required: false
      isArray: false
    - name: username
      description: Username for Kubernetes authentication.
      required: false
      isArray: false
    - name: type
      description: The type of access entry to create.
      required: false
      isArray: false
      defaultValue: Standard
      auto: PREDEFINED
      predefined:
      - Standard
      - FARGATE_LINUX
      - EC2_LINUX
      - EC2_WINDOWS
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.CreateAccessEntry.clusterName
      description: The name of the cluster.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.principalArn
      description: The ARN of the IAM principal for the access entry.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.kubernetesGroups
      description: A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.accessEntryArn
      description: The ARN of the access entry.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.createdAt
      description: The creation date of the object.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.modifiedAt
      description: The date and time for the last modification to the object.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.tags
      description: A dictionary containing metadata for categorization and organization.
      type: Object
    - contextPath: AWS.EKS.CreateAccessEntry.username
      description: The name of a user that can authenticate to the cluster.
      type: String
    - contextPath: AWS.EKS.CreateAccessEntry.type
      description: The type of the access entry.
      type: String
  - name: aws-eks-associate-access-policy
    description: Associates an access policy and its scope to an access entry.
    arguments:
    - name: cluster_name
      description: The name of the cluster for which to create an access entry.
      required: true
      isArray: false
    - name: principal_arn
      description: The Amazon Resource Name (ARN) of the IAM user or role for the AccessEntry that you’re associating the access policy to.
      required: true
      isArray: false
    - name: policy_arn
      description: The ARN of the AccessPolicy that you’re associating.
      required: true
      isArray: false
    - name: type
      description: The scope type of an access policy.
      required: true
      isArray: false
      auto: PREDEFINED
      predefined:
      - cluster
      - namespace
    - name: namespaces
      description: A comma-separated list of Kubernetes namespaces that an access policy is scoped to. A value is required if you specified namespace for type.
      required: false
      isArray: false
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.AssociatedAccessPolicy.clusterName
      description: The name of your cluster.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.principalArn
      description: The ARN of the IAM principal for the AccessEntry.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.policyArn
      description: The ARN of the AccessPolicy.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.accessScope.type
      description: The scope type of an access policy.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.accessScope.namespaces
      description: A Kubernetes namespace that an access policy is scoped to.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.associatedAt
      description: The date and time the AccessPolicy was associated with an AccessEntry.
      type: String
    - contextPath: AWS.EKS.AssociatedAccessPolicy.modifiedAt
      description: The date and time for the last modification to the object.
      type: String
  - name: aws-eks-update-access-entry
    description: Updates an access entry.
    arguments:
    - name: cluster_name
      description: The name of the cluster.
      required: true
      isArray: false
    - name: principal_arn
      description: ARN of the IAM principal for the AccessEntry.
      required: true
      isArray: false
    - name: kubernetes_groups
      description: A comma-separated list of names for Kubernetes groups in RoleBindings or ClusterRoleBindings.
      required: false
      isArray: false
    - name: client_request_token
      description: Unique identifier for idempotency.
      required: false
      isArray: false
    - name: username
      description: Username for Kubernetes authentication.
      required: false
      isArray: false
    - auto: PREDEFINED
      description: The AWS Region. If not specified, the configured region will be used.
      name: region
      predefined:
        - us-east-1
        - us-east-2
        - us-west-1
        - us-west-2
        - ca-central-1
        - eu-west-1
        - eu-central-1
        - eu-west-2
        - ap-northeast-1
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-south-1
        - sa-east-1
        - eu-north-1
        - eu-west-3
    outputs:
    - contextPath: AWS.EKS.UpdateAccessEntry.clusterName
      description: The name of your cluster.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.principalArn
      description: The ARN of the IAM principal for the access entry.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.kubernetesGroups
      description: A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
      type: List
    - contextPath: AWS.EKS.UpdateAccessEntry.accessEntryArn
      description: The ARN of the access entry.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.createdAt
      description: The creation date of the object.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.modifiedAt
      description: The date and time for the last modification to the object.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.tags
      description: Metadata that assists with categorization and organization. Each tag consists of a key and an optional value.
      type: Object
    - contextPath: AWS.EKS.UpdateAccessEntry.username
      description: The name of a user that can authenticate to your cluster.
      type: String
    - contextPath: AWS.EKS.UpdateAccessEntry.type
      description: The type of the access entry.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/boto3py3:1.0.0.10221838
fromversion: 6.9.0
tests:
- AWSEKS-Test