Update IAM settings for your Workspace

AWS Cloud9 normally manages IAM credentials dynamically. This isn’t currently compatible with the EKS IAM (Identity and Access Management) authentication, so we will disable it and rely on the IAM role instead.

  • From within your workspace, click the sprocket, or launch a new tab to open the Preferences tab
  • Turn off AWS managed temporary credentials
  • Close the Preferences tab c9disableiam

Install command line tools

Install command line tools by executing:


Make sure to reload bash profile

source ~/.bash_profile

To ensure temporary credentials aren’t already in place we will also remove any existing credentials file:

rm -vf ${HOME}/.aws/credentials

We should configure our aws cli with our current region as default:

export ACCOUNT_ID=$(aws sts get-caller-identity --output text --query Account)
export AWS_REGION=$(curl -s | jq -r '.region')

echo "export ACCOUNT_ID=${ACCOUNT_ID}" >> ~/.bash_profile
echo "export AWS_REGION=${AWS_REGION}" >> ~/.bash_profile
aws configure set default.region ${AWS_REGION}
aws configure get default.region

Configure kubectl so you can connect to the EKS cluster

aws eks update-kubeconfig --name 'EKS-Lab'

Validate the IAM role

Use the GetCallerIdentity CLI command to validate that the Cloud9 IDE is using the correct IAM role.

aws sts get-caller-identity

The output assumed-role name should contain:



If the Arn contains the role name from above and an Instance ID, you may proceed.

    "Account": "123456789", 
    "UserId": "AROASZJSJAGFMMAJLP52A:MasterKey", 
    "Arn": "arn:aws:sts::191768363402:assumed-role/TeamRole/i-032qawsee877f6d01"