IAM agent
IRSA, EKS Pod Identity, IAM trust and permissions, Kubernetes RBAC, EKS access entries, and legacy aws-auth mappings.
Diagnostic approach
Identify the caller and failed action. Check the service account and its identity association, trust conditions, policy scope, endpoint access, and RBAC binding. Distinguish IAM denial from Kubernetes Forbidden before changing permissions.
Initial read-only checks
Run only in the intended account, region, and Kubernetes context. Service-specific follow-ups come from the observed result.
aws sts get-caller-identity
kubectl get serviceaccounts -A
kubectl get clusterrolebindings
kubectl get configmap aws-auth -n kube-system -o yaml
Evidence and handoff
Return the affected component, observed symptoms, supporting output, likely cause, proposed action, and a verification command with expected results. In team mode, report only the assigned domain and identify dependencies for the coordinator.
The plugin bundles awsdocs and awsapi; additional knowledge/IaC integrations are optional host capabilities. Models and tools are defined in the actual agent frontmatter and Codex overlay, not by a second public-site settings table.