--- title: Secure Amazon EKS Access with Teleport | daily.dev description: A step-by-step tutorial walks through securing Amazon EKS clusters using Teleport as an identity-aware access proxy. It covers setting up Teleport as a bastion... canonical: https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Secure Amazon EKS Access with Teleport | daily.dev og:description: A step-by-step tutorial walks through securing Amazon EKS clusters using Teleport as an identity-aware access proxy. It covers setting up Teleport as a bastion... og:url: https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf og:image: https://api.daily.dev/og/posts/Ly9nPeAQF.png og:image:alt: Secure Amazon EKS Access with Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Secure Amazon EKS Access with Teleport **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary A step-by-step tutorial walks through securing Amazon EKS clusters using Teleport as an identity-aware access proxy. It covers setting up Teleport as a bastion host, launching staging and production EKS clusters with eksctl, deploying the Teleport Kubernetes agent via Helm to each cluster, and accessing clusters through tsh commands instead of sharing raw kubeconfig files. Benefits highlighted include identity-based access with auto-expiring certificates, just-in-time access requests for production, and consolidated RBAC policy across environments. A follow-up part will cover adding SSO for EKS access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I secure access to multiple Amazon EKS clusters for staging and production without sharing kubeconfig files? Deploy Teleport as a bastion proxy with an auth server, then install the teleport-kube-agent Helm chart in each EKS cluster with a unique auth token, proxy address, and environment label. Users log in with tsh kube login , which auto-generates kubeconfig entries per session instead of distributing the raw kubeconfig file to every user. _daily.dev surfaces practical guides like this for teams locking down multi-cluster Kubernetes access._ ### How do you connect the Teleport Kubernetes agent to an EKS cluster using Helm? Install the teleport-kube-agent chart from the teleport Helm repository, passing kubeClusterName, proxyAddr, authToken, and an env label, then create a dedicated teleport-agent namespace. The token is generated beforehand with tctl nodes add --roles=kube --ttl=10000h --format=json and must be applied separately for each cluster, such as staging and production. _Engineers wiring up Kubernetes access controls can find setup walkthroughs like this via daily.dev._ ## Similar posts on daily.dev - [Building a Production Style Kubernetes Platform on AWS with Amazon EKS](https://daily.dev/posts/building-a-production-style-kubernetes-platform-on-aws-with-amazon-eks-dh3yqcvc2) · Medium · 3 upvotes · 0 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Secure Amazon EKS Access with Teleport","url":"https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf"},"datePublished":"2026-08-23T12:23:24.160Z","dateModified":"2026-08-23T12:55:27.455Z","description":"A step-by-step tutorial walks through securing Amazon EKS clusters using Teleport as an identity-aware access proxy. It covers setting up Teleport as a bastion...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,kubernetes","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Secure Amazon EKS Access with Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/secure-amazon-eks-access-with-teleport-ly9npeaqf#faq","mainEntity":[{"@type":"Question","name":"How do I secure access to multiple Amazon EKS clusters for staging and production without sharing kubeconfig files?","acceptedAnswer":{"@type":"Answer","text":"Deploy Teleport as a bastion proxy with an auth server, then install the teleport-kube-agent Helm chart in each EKS cluster with a unique auth token, proxy address, and environment label. Users log in with tsh kube login , which auto-generates kubeconfig entries per session instead of distributing the raw kubeconfig file to every user. daily.dev surfaces practical guides like this for teams locking down multi-cluster Kubernetes access."}},{"@type":"Question","name":"How do you connect the Teleport Kubernetes agent to an EKS cluster using Helm?","acceptedAnswer":{"@type":"Answer","text":"Install the teleport-kube-agent chart from the teleport Helm repository, passing kubeClusterName, proxyAddr, authToken, and an env label, then create a dedicated teleport-agent namespace. The token is generated beforehand with tctl nodes add --roles=kube --ttl=10000h --format=json and must be applied separately for each cluster, such as staging and production. Engineers wiring up Kubernetes access controls can find setup walkthroughs like this via daily.dev."}}]} ```