--- title: "Update IAM settings for your Workspace" chapter: false weight: 16 pre: "2. " --- {{% notice info %}} Cloud9 normally manages IAM credentials dynamically. This isn't currently compatible with the EKS IAM authentication, so we will disable it and rely on the IAM role instead. {{% /notice %}} - Return to your [cloud9 workspace](https://us-west-2.console.aws.amazon.com/cloud9/home#) and click the sprocket, or launch a new tab to open the Preferences tab - Select **AWS SETTINGS** - Turn off **AWS managed temporary credentials** - Close the Preferences tab ![c9disableiam](/images/c9disableiam.png) To ensure temporary credentials aren't already in place we will also remove any existing credentials file: ``` rm -vf ${HOME}/.aws/credentials ``` Install JQ and envsubst: ``` sudo yum -y install jq gettext ``` We should configure our aws cli with our current region as default: ``` export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --output text --query Account) export AWS_REGION=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r '.region') echo "export AWS_ACCOUNT_ID=${AWS_ACCOUNT_ID}" >> ~/.bash_profile echo "export AWS_REGION=${AWS_REGION}" >> ~/.bash_profile aws configure set default.region ${AWS_REGION} aws configure get default.region ``` ### Validate the IAM role Use the [GetCallerIdentity](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html) CLI command to validate that the Cloud9 IDE is using the correct IAM role. ``` aws sts get-caller-identity ``` The output assumed-role name should contain: ``` amazonk8snetworkshop-admin ``` #### VALID If the _Arn_ contains the role name from above and an Instance ID, you may proceed. ```output { "Account": "123456789012", "UserId": "AROAYD7CFQJWZSIEXYJCC:i-0668085e67f9144a1", "Arn": "arn:aws:sts::123456789012:assumed-role/amazonk8snetworkshop-admin/i-0668085e67f9144a1" } ``` #### INVALID If the _Arn_ contains `TeamRole`, `MasterRole`, or does not match the role name output above, **DO NOT PROCEED**. Go back and confirm the steps on this page. ```output { "Account": "123456789012", "UserId": "AROA1SAMPLEAWSIAMROLE:i-01234567890abcdef", "Arn": "arn:aws:sts::123456789012:assumed-role/TeamRole/MasterRole" } ```