Using Amazon Bedrock agents to automate creation of access entry controls in Amazon EKS through text-based prompts
Created by Keshav Ganesh (AWS) and Sudhanshu Saurav (AWS)
Summary
Organizations face challenges in managing access controls and resource provisioning when multiple teams need to work with a shared Amazon Elastic Kubernetes Service (Amazon EKS) cluster. A managed Kubernetes service such as Amazon EKS has simplified cluster operations. However, the administrative overhead of managing team access and resource permissions remains complex and time-consuming.
This pattern shows how Amazon Bedrock agents can help you automate Amazon EKS cluster access management. This automation allows development teams to focus on their core application development rather than dealing with access control setup and management. You can customize an Amazon Bedrock agent to perform actions for a wide variety of tasks through simple natural language prompts.
By using AWS Lambda functions as action groups, an Amazon Bedrock agent can handle tasks such as creating user access entries and managing access policies. In addition, an Amazon Bedrock agent can configure pod identity associations that allow access to AWS Identity and Access Management (IAM) resources for the pods running in the cluster. Using this solution, organizations can streamline their Amazon EKS cluster administration with simple text-based prompts, reduce manual overhead, and improve overall development efficiency.
Prerequisites and limitations
Prerequisites
An active AWS account.
Established IAM roles and permissions for the deployment process. This includes permissions to access Amazon Bedrock foundation models (FM), create Lambda functions, and any other required resources across the target AWS accounts.
Access enabled in the active AWS account to these Amazon Bedrock FMs: Amazon Titan Text Embeddings V2 and Anthropic Claude 3 Haiku.
AWS Command Line Interface (AWS CLI) version 2.9.11 or later, installed and configured.
eksctl 0.194.0 or later, installed
.
Limitations
Training and documentation might be required to help ensure smooth adoption and effective use of these techniques. Using Amazon Bedrock, Amazon EKS, Lambda, Amazon OpenSearch Service, and OpenAPI
involve a significant learning curve for developers and DevOps teams. Some AWS services aren’t available in all AWS Regions. For Region availability, see AWS services by Region
. For specific endpoints, see Service endpoints and quotas, and choose the link for the service.
Architecture
The following diagram shows the workflow and architecture components for this pattern.

This solution performs the following steps:
The user interacts with the Amazon Bedrock agent by submitting a prompt or query that serves as input for the agent to process and take action.
Based on the prompt, the Amazon Bedrock agent checks the OpenAPI schema to identify the correct API to target. If the Amazon Bedrock agent finds the correct API call, the request goes to the action group that is associated with the Lambda function that implements these actions.
If a relevant API isn’t found, the Amazon Bedrock agent queries the OpenSearch collection. The OpenSearch collection uses indexed knowledge base content that is sourced from the Amazon S3 bucket that contains the Amazon EKS User Guide.
The OpenSearch collection returns relevant contextual information to the Amazon Bedrock agent.
For actionable requests (those that match an API operation), the Amazon Bedrock agent executes within a virtual private cloud (VPC) and triggers the Lambda function.
The Lambda function performs an action that’s based on the user’s input inside the Amazon EKS cluster.
The Amazon S3 bucket for the Lambda code stores the artifact that has the code and logic written for the Lambda function.
Tools
AWS services
Amazon Bedrock is a fully managed service that makes high-performing foundation models (FMs) from leading AI startups and Amazon available for your use through a unified API.
AWS CloudFormation helps you set up AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle across AWS accounts and AWS Regions.
Amazon Elastic Kubernetes Service (Amazon EKS) helps you run Kubernetes on AWS without needing to install or maintain your own Kubernetes control plane or nodes.
AWS Identity and Access Management (IAM) helps you securely manage access to your AWS resources by controlling who is authenticated and authorized to use them.
AWS Lambda is a compute service that helps you run code without needing to provision or manage servers. It runs your code only when needed and scales automatically, so you pay only for the compute time that you use.
Amazon OpenSearch Service is a managed service that helps you deploy, operate, and scale OpenSearch clusters in the AWS Cloud. Its collections feature helps you to organize your data and build comprehensive knowledge bases that AI assistants such as Amazon Bedrock agents can use.
Amazon Simple Storage Service (Amazon S3) is a cloud-based object storage service that helps you store, protect, and retrieve any amount of data.
Other tools
eksctl is a command-line utility for creating and managing Kubernetes clusters on Amazon EKS.
Code repository
The code for this pattern is available in the GitHub eks-access-controls-bedrock-agent
Best practices
Maintain the highest possible security when implementing this pattern. Make sure that the Amazon EKS cluster is private, has limited access permissions, and all the resources are inside a virtual private cloud (VPC). For additional information, see Best practices for security in the Amazon EKS documentation.
Use AWS KMS customer managed keys wherever possible, and grant limited access permissions to them.
Follow the principle of least privilege and grant the minimum permissions required to perform a task. For more information, see Grant least privilege and Security best practices in the IAM documentation.
Epics
Task | Description | Skills required |
---|---|---|
Clone the repository. | To clone this pattern’s repository, run the following command in your local workstation:
| AWS DevOps |
Get the AWS account ID. | To get the AWS account ID, use the following steps:
This command stores your AWS account ID in the | AWS DevOps |
Create the S3 bucket for Lambda code. | To implement this solution, you must create three Amazon S3 buckets that serve different purposes, as shown in the architecture diagram. The S3 buckets are for Lambda code, a knowledge base, and OpenAPI schema. To create the Lambda code bucket, use the following steps:
The package command creates a new CloudFormation template (
| AWS DevOps |
Create the S3 bucket for the knowledge base. | To create the Amazon S3 bucket for the knowledge base, use the following steps:
| AWS DevOps |
Create the S3 bucket for the OpenAPI schema. | To create the Amazon S3 bucket for the OpenAPI schema, use the following steps:
| AWS DevOps |
Task | Description | Skills required |
---|---|---|
Deploy the CloudFormation stack. | To deploy the CloudFormation stack, use the CloudFormation template file NoteProvisioning the OpenSearch index with the CloudFormation template takes about 10 minutes. After the stack is created, make a note of the | AWS DevOps |
Create the Amazon EKS cluster. | To create the Amazon EKS cluster inside the VPC, use the following steps:
The expected results are as follows:
| AWS DevOps |
Task | Description | Skills required |
---|---|---|
Create a connection between the Amazon EKS cluster and the Lambda function. | To set up network and IAM permissions to allow the Lambda function to communicate with the Amazon EKS cluster, use the following steps:
| AWS DevOps |
Task | Description | Skills required |
---|---|---|
Test the Amazon Bedrock agent. | Before testing the Amazon Bedrock agent, make sure that you do the following:
To access the Amazon Bedrock agent, use the following steps:
You can also ask the agent to perform actions for EKS Pod Identity associations. For more details, see Learn how EKS Pod Identity grants pods access to AWS services in the Amazon EKS documentation. | AWS DevOps |
Task | Description | Skills required |
---|---|---|
Clean up resources. | To clean up the resources that this pattern created, use the following procedure. Wait for each deletion step to complete before proceeding to the next step. WarningThis procedure will permanently delete all resources created by these stacks. Make sure that you've backed up any important data before proceeding.
| AWS DevOps |
Troubleshooting
Issue | Solution |
---|---|
A non-zero error code is returned during environment setup. | Verify that you’re using the correct folder when running any command to deploy this solution. For more information, see the FIRST_DEPLOY.md |
The Lambda function isn’t able to do the task. | Make sure that connectivity is set up correctly from the Lambda function to the Amazon EKS cluster. |
The agent prompts don’t recognize the APIs. | Redeploy the solution. For more information, see the RE_DEPLOY.md |
The stack fails to delete. | An initial attempt to delete the stack might fail. This failure can occur because of dependency issues with the custom resource that was created for the OpenSearch collection which does the indexing for the knowledge base. To delete the stack, retry the delete operation by retaining the custom resource. |
Related resources
AWS Blog
Amazon Bedrock documentation
Amazon EKS documentation