> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller/install-the-snyk-controller-on-amazon-elastic-kubernetes-service-amazon-eks.md).

# Install the Snyk Controller on Amazon Elastic Kubernetes Service (Amazon EKS)

How to install the Snyk Controller on Amazon EKS

{% hint style="info" %}
Ensure you have reviewed the [prerequisites for installing the Snyk Controller](/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller.md#prerequisites-for-installing-the-snyk-controller).
{% endhint %}

{% hint style="info" %}
The installation steps work best for EKS and ECR with the same AWS account. If you have a different setup, contact [Snyk support](https://support.snyk.io).
{% endhint %}

Installing the Snyk Controller enables you to import and test your running EKS workloads and identify vulnerabilities in their associated images and configurations that can make the workloads less secure. After the workload is imported, Snyk continues to monitor the workload, identifying additional security issues, as new images are deployed and the workload configuration changes.

The steps described below provide instructions for configuring the Snyk Controller to pull and scan private images from ECR.

To install Amazon EKS:

1\. Access your Kubernetes environment. Run the following command in order to add the Snyk Charts repository to Helm:

```
helm repo add snyk-charts https://snyk.github.io/kubernetes-monitor --force-update
```

2\. After the repository is added, create a unique namespace for the Snyk Controller:

```
kubectl create namespace snyk-monitor
```

{% hint style="info" %}
As a good practice for Kubernetes applications, use a unique namespace to isolate the controller resources easily.

Ensure you remember the namespace `snyk-monitor`. You will use it when configuring other resources.
{% endhint %}

3\. Create a file named "dockercfg.json" and ensure it matches the following example:

```
{
  "credsStore": "ecr-login"
}
```

For additional setup for private registries, see [Authenticate to private container registries](/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller/authenticate-to-private-container-registries.md).

4\. Create a Kubernetes secret containing your Integration ID, service account token, and dockercfg.json file:

```
kubectl create secret generic snyk-monitor \
        -n snyk-monitor --from-file=dockercfg.json \
        --from-literal=integrationId=abcd1234-abcd-1234-abcd-1234abcd1234 \
        --from-literal=serviceAccountApiToken=bdca4123-dbca-4343-bbaa-1313cbad4231
```

5\. Attach policies or roles for nodes. You can do this using one of the below options:

#### Attach policies for worker nodes

1. Attach the `NodeInstanceRole` policy. See [Using Amazon ECR Images with Amazon EKS](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html).
2. Attach the `AmazonEC2ContainerRegistryReadOnly` policy to your EKS worker nodes.\
   The Snyk Controller is now able to pull private images when running on those worker nodes.

#### Create an EKS node role for your Node Group and add the Trust Relationship for the IAM Role

1. Follow the instructions on [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) and check your existing node role. Ensure you have attached the policy `AmazonEC2ContainerRegistryReadOnly`**.**
2. For the Snyk Controller to successfully assume the IAM role and pull images from ECR, the role's trust policy must be configured to trust your EKS cluster's OIDC provider. Create the trust policy document in JSON format and apply this trust policy document to the IAM role that the Snyk Controller will use.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::{account_id}:oidc-provider/oidc.eks.{aws_region}.amazonaws.com/id/{oidc_provider}"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.{aws_region}.amazonaws.com/id/{oidc_provider}:sub": "system:serviceaccount:snyk-monitor:snyk-monitor"
        }
      }
    }
  ]
}
```

1. Navigate to the **Details** tab on your EKS node group page, where you see `Node IAM Role ARN`

```
arn:aws:iam::<role-id>:role/<role-name>
```

3. Create a \<newFile>.yaml with the following content:

```
volumes:
  projected:
    serviceAccountToken: true
    
securityContext:
  fsGroup: 65534

rbac:
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: <Node IAM Role ARN>
```

4. Install the Snyk Controller.

After creating the IAM role for your service account, you can install your Snyk Controller with the newly created YAML file to overwrite the values in the Helm chart.

```
helm upgrade --install snyk-monitor snyk-charts/snyk-monitor \
             --namespace snyk-monitor \
             --set clusterName=<ENTER_CLUSTER_NAME> \
             -f <newFile>.yaml
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller/install-the-snyk-controller-on-amazon-elastic-kubernetes-service-amazon-eks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.