Amazon EKS — Prerequisites — Practice Exercises

4 minute read

Chapter 2 — Practice Exercises

Test your tool setup knowledge with these 5 exercises.

Exercise 1: Multiple AWS Profiles

Question: You have two AWS accounts — one for development and one for production. How do you configure AWS CLI to work with both? Show the commands and explain how to switch between them.

Show Solution

Configure both profiles:

# Development account
$ aws configure --profile dev
AWS Access Key ID: AKIA_DEV_KEY
AWS Secret Access Key: dev_secret_key
Default region name: us-east-1
Default output format: json

# Production account
$ aws configure --profile prod
AWS Access Key ID: AKIA_PROD_KEY
AWS Secret Access Key: prod_secret_key
Default region name: us-east-1
Default output format: json

Switch between profiles:

# Method 1: Environment variable (affects all commands)
$ export AWS_PROFILE=dev
$ aws sts get-caller-identity    # Uses dev account

$ export AWS_PROFILE=prod
$ aws sts get-caller-identity    # Uses prod account

# Method 2: Per-command flag
$ aws sts get-caller-identity --profile dev
$ aws sts get-caller-identity --profile prod

Best practice: Always verify which profile is active before running commands:

$ echo $AWS_PROFILE
$ aws sts get-caller-identity

Exercise 2: Tool Version Compatibility

Question: Your kubectl is version 1.25 and you want to create an EKS cluster running Kubernetes 1.29. Will this work? What’s the rule for kubectl version compatibility?

Show Solution

No, this will not work correctly.

kubectl version skew policy:

  • kubectl must be within ±1 minor version of the cluster’s Kubernetes version
  • kubectl 1.25 can only work with clusters running 1.24, 1.25, or 1.26
  • For a 1.29 cluster, you need kubectl 1.28, 1.29, or 1.30

Fix:

# Check current version
$ kubectl version --client
Client Version: v1.25.0   # Too old!

# Update kubectl (macOS)
$ brew upgrade kubectl

# Or download specific version
$ curl -LO "https://dl.k8s.io/release/v1.29.3/bin/darwin/amd64/kubectl"
$ chmod +x kubectl
$ sudo mv kubectl /usr/local/bin/

# Verify
$ kubectl version --client
Client Version: v1.29.3   # Now compatible

Exercise 3: IAM Security Best Practice

Question: Why is using an IAM role better than an IAM user with access keys for production EKS management? List 3 reasons.

Show Solution

Three reasons IAM roles are better than IAM users for production:

  1. Temporary credentials — Roles issue credentials that expire (typically 1 hour). Access keys are permanent until manually rotated, meaning a leaked key gives indefinite access.

  2. No credentials to manage — With roles, you never see or store credentials. With access keys, they exist in ~/.aws/credentials, environment variables, or CI/CD secrets — all potential leak vectors.

  3. Audit trail — When you assume a role, the session has a unique name and temporary credentials, making it easier to trace who did what. With shared access keys, multiple people might use the same key.

Additional benefits:

  • Cross-account access without sharing keys
  • Can enforce MFA for role assumption
  • Easier to revoke (modify trust policy vs rotating and distributing new keys)
  • Works naturally with EC2 instance profiles, ECS task roles, and Lambda execution roles

Exercise 4: eksctl Under the Hood

Question: When you run eksctl create cluster --name demo, what AWS resources does eksctl create? List at least 8 resources and explain which CloudFormation stacks are created.

Show Solution

CloudFormation stacks created:

  1. eksctl-demo-cluster — Contains cluster-level resources
  2. eksctl-demo-nodegroup-ng-xxxxxx — Contains node group resources

Resources created (at least 8):

  1. VPC — A new VPC (default CIDR: 192.168.0.0/16)
  2. Subnets — 2 public + 2 private subnets across 2 AZs
  3. Internet Gateway — For public subnet internet access
  4. NAT Gateway(s) — For private subnet outbound access
  5. Route Tables — Public and private route tables
  6. EKS Cluster — The managed Kubernetes control plane
  7. IAM Cluster Role — Role that EKS uses to manage AWS resources
  8. IAM Node Role — Role attached to worker node EC2 instances
  9. Security Groups — For cluster-to-node and node-to-node communication
  10. Managed Node Group — EC2 Auto Scaling group with worker nodes
  11. OIDC Provider — For IRSA (IAM Roles for Service Accounts)
  12. kubeconfig update — Adds cluster to your ~/.kube/config

Verify with:

$ aws cloudformation list-stacks --query "StackSummaries[?contains(StackName, 'eksctl-demo')]"

Exercise 5: Debug Installation Issues

Question: You run eksctl create cluster and get: Error: unable to determine AMI: no AMI was found. What are 3 possible causes and how would you fix each?

Show Solution

Possible causes and fixes:

  1. Wrong region — The AMI might not be available in your selected region 
    # Check current region
$ aws configure get region
   
# Fix: Use a major region
$ eksctl create cluster --name demo --region us-east-1
  2. Old eksctl version — Older eksctl versions might reference outdated AMI IDs 
    # Check version
$ eksctl version
   
# Update
$ brew upgrade eksctl
# Or re-download the latest binary
  3. Unsupported Kubernetes version — The requested K8s version might not have a matching AMI 
    # eksctl might default to a version with no AMI
# Fix: Specify a supported version
$ eksctl create cluster --name demo --version 1.29

General debugging approach:

# Check available EKS versions in your region
$ aws eks describe-addon-versions --query 'addons[0].addonVersions[*].compatibilities[*].clusterVersion' --output text | sort -u

# Check available AMIs
$ aws ssm get-parameter \
    --name /aws/service/eks/optimized-ami/1.29/amazon-linux-2/recommended/image_id \
    --query 'Parameter.Value' --output text

What’s Next?

Great job! You’re now fully set up. Head to Chapter 3 — Creating Your First Cluster to create your first EKS cluster.

You may also enjoy