DEV Community

Andy Tan
Andy Tan

Posted on

Installing the AWS CLI, kubectl and eksctl on macOS

#aws #cli #kubectl #eksctl

Overview

Working with Amazon Elastic Kubernetes Service (EKS) from a Mac takes three command-line tools, and they build on each other in the order below:

  • AWS CLI — authenticates you to AWS and is the tool every later step relies on for credentials and identity.
  • kubectl — the standard Kubernetes client, used to talk to the API server of an EKS cluster once one exists.
  • eksctl — a higher-level tool that creates and manages EKS clusters, driving CloudFormation underneath. The versions used in the source walkthrough were Kubernetes 1.30 (kubectl v1.30.8-eks-aeac579) and eksctl 0.207.0. Check the AWS documentation for current releases before copying version-pinned URLs — the S3 paths below embed both a version and a build date, and they change.

1. AWS CLI

1.1 Create an access key
Before installing anything, create an access key for the IAM user you intend to work as. In the AWS Management Console this is under IAM → Users → your user → Security credentials → Create access key. The console shows you the Access Key ID and the Secret Access Key once; the secret cannot be retrieved again afterwards, so store it somewhere safe at that moment.

Image note: the original article illustrates this step with screenshots of the IAM console's access-key creation screens. Those images are the author's and are not reproduced here — see the original post if you want the visual reference.
Security note: an IAM access key is a long-lived credential. Prefer a dedicated, least-privilege IAM user or, better, IAM Identity Center / SSO sessions where your organisation supports them, and rotate keys regularly.

1.2 Install or update the CLI
AWS ships a signed macOS installer package. Download it and install it system-wide:

curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /
Enter fullscreen mode Exit fullscreen mode

The same two commands also perform an in-place upgrade of an existing AWS CLI v2 installation — there is no separate update path.

1.3 Confirm the shell can find it
Check that the binary resolved onto your $PATH and reports a version:

which aws
aws --version
Enter fullscreen mode Exit fullscreen mode

If which aws returns nothing, open a new terminal session so the shell re-reads its PATH, or add /usr/local/bin to it.

1.4 Configure credentials
Run the interactive configuration and supply the access key you created in step 1.1, along with a default region and output format:

aws configure

AWS Access Key ID     [****************I66M]:
AWS Secret Access Key [****************o4pv]:
Default region name   [us-east-1]:
Default output format [json]:
Enter fullscreen mode Exit fullscreen mode

The bracketed values are the existing settings, shown masked; pressing Return keeps them. Answers are written to ~/.aws/credentials and ~/.aws/config.

1.5 Verify who you are
This call returns the identity AWS resolves your credentials to, and is the quickest way to confirm the CLI is working:

aws sts get-caller-identity

{
    "UserId":  "AIDAxxxxxxxxxxxxxxxxx",
    "Account": "123456789012",
    "Arn":     "arn:aws:iam::123456789012:user/your-user"
}
Enter fullscreen mode Exit fullscreen mode

Make a note of this identity. The eksctl step further down requires that every command be run as the same IAM principal.

2. kubectl

AWS publishes kubectl binaries matched to each supported EKS Kubernetes version. The walkthrough targets Kubernetes 1.30.

2.1 Download the binary
Fetch the binary for your platform from the Amazon EKS S3 bucket. The path encodes the Kubernetes version, the build date and the CPU architecture — use arm64 in place of amd64 on Apple Silicon:

curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.30.8/2025-01-10/bin/darwin/amd64/kubectl
Enter fullscreen mode Exit fullscreen mode

The source article's command line ends in kubectl.sha256, which downloads the checksum file rather than the binary itself. The checksum is useful — download it as well and verify with openssl sha1 -sha256 kubectl — but the binary is the file without the .sha256 suffix, as written above.

2.2 Make it executable and put it on your PATH

chmod +x ./kubectl
Enter fullscreen mode Exit fullscreen mode

If you already have another kubectl installed, the recommended approach is a per-user copy in $HOME/bin placed ahead of everything else on the PATH, so it takes precedence without disturbing the existing installation:

mkdir -p $HOME/bin && cp ./kubectl $HOME/bin/kubectl && export PATH=$HOME/bin:$PATH
Enter fullscreen mode Exit fullscreen mode

Persist that PATH entry in your shell's startup file so it survives new terminal windows:

echo 'export PATH=$HOME/bin:$PATH' >> ~/.bash_profile
Enter fullscreen mode Exit fullscreen mode

~/.bash_profile only applies if your login shell is bash. macOS has defaulted to zsh since Catalina — in that case append the same line to ~/.zshrc instead. Check with echo $SHELL.

2.3 Verify

kubectl version --client

Client Version: v1.30.8-eks-aeac579
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Enter fullscreen mode Exit fullscreen mode

The -eks- suffix confirms you are running the AWS-published build rather than an upstream one.

3. eksctl

3.1 Prerequisites
eksctl creates clusters by provisioning CloudFormation stacks, so the IAM principal you use needs permission to work with Amazon EKS IAM roles, service-linked roles, AWS CloudFormation, VPCs and the networking resources that go with them. A user without those permissions will fail partway through cluster creation rather than at the start.
All steps must be carried out as the same user. Re-run the identity check if you are unsure which principal the CLI is currently using:

aws sts get-caller-identity
Enter fullscreen mode Exit fullscreen mode

3.2 Install via Homebrew
On macOS the maintained route is the Weaveworks Homebrew tap:

brew tap weaveworks/tap
brew install weaveworks/tap/eksctl
Enter fullscreen mode Exit fullscreen mode

3.3 Verify

eksctl version

0.207.0
Enter fullscreen mode Exit fullscreen mode

Putting it together

At this point all three tools are installed and the AWS CLI holds working credentials. The usual next step is to create a cluster with eksctl, which also writes the cluster's connection details into your kubeconfig so that kubectl can reach it. If you are attaching to a cluster that already exists, the AWS CLI can generate that kubeconfig entry directly:

aws eks update-kubeconfig --region us-east-1 --name your-cluster-name
kubectl get nodes
Enter fullscreen mode Exit fullscreen mode

A successful kubectl get nodes confirms that all three pieces — credentials, Kubernetes client, and cluster access — are wired together correctly.

Top comments (0)