<p>Searching through the Internet, I have seen that EKS only enables IAM authentication for IAM users.<br>
Is it possible to configure client certificate authentication manually? I mean, create Kubernetes users and roles internally and not use IAM authentication.</p>

<p>Kubernetes supports several authentication modules, for example:</p>

<ul>
<li><p>X509 client certificates</p></li>
<li><p>Service account tokens</p></li>
<li><p>OpenID Connect tokens</p></li>
<li><p>Webhook token authentication</p></li>
<li><p>Authenticating proxy, etc.</p></li>
</ul>

<p>You can find more details regarding them in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">official documentation</a>.</p>

<p>However, Amazon EKS uses only one specific authentication method, an implementation of a webhook token authentication to authenticate Kube API requests. This webhook service is implemented by an open source tool called AWS IAM Authenticator, which has both client and server sides.</p>

<p>In short, the client sends a token (which includes the AWS IAM identity—user or role—making the API call) which is verified on the server-side by the webhook service.</p>

<p>So the answer to your question is: if you choose to use EKS you only have one authentication option which is IAM.</p>

<p>I hope it helps. </p>
