
Secure Kubecost dashboard access for external users by integrating Amazon Cognito authentication with Application Load Balancer on Amazon EKS using CDK blueprints.


<div><p>This article explains how to secure Kubecost dashboard access using Amazon Cognito authentication on Amazon EKS.</p><ul><li>Kubecost provides real-time cost visibility and insights for Kubernetes workloads</li><li>Default NGINX basic authentication is replaced with Amazon Cognito for production security</li><li>Solution uses Application Load Balancer (ALB) to expose Kubecost dashboard externally</li><li>Amazon Cognito authenticates and authorizes users via email domain allow-listing</li><li>Pre sign-up Lambda trigger validates user email domains before account creation</li><li>Deployment uses EKS Blueprints CDK pattern with Route 53, ACM certificates, and TLS</li><li>Includes Kubernetes add-ons: Metrics Server, Cluster Autoscaler, AWS Load Balancer Controller</li><li>Users sign up with allowed email domains and verify via email confirmation code</li><li>Can integrate existing OIDC or SAML 2.0 identity providers with Cognito</li></ul><p>This solution enables secure, externally-accessible Kubecost dashboards for finance teams without requiring cluster access.</p></div>


Related articles