> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/app-embedded/deploy-app-embedded-aws-fargate-amazon-eks.md).

# Deploy App-Embedded Defender on AWS Fargate for Amazon EKS

Follow these steps to deploy and validate the App-Embedded Defender on AWS Fargate for Amazon Elastic Kubernetes Service (EKS).

## Prerequisites

To get started, you’ll need the following:

* An existing Amazon EKS cluster with a configured Fargate profile. For detailed setup instructions, see the AWS documentation.
* The AWS account hosting the EKS cluster must be already set up and accessible in your Prisma Cloud console. See the Prisma Cloud documentation for account setup procedures.

## Configure AWS IAM Roles for Service Accounts (IRSA)

Ensure that **IAM Roles for Service Accounts (IRSA)** is configured within AWS EKS Fargate and mapped to the service account used by the Kubernetes pods you want to protect.

1. **Enable the IAM OIDC Provider**: Establish an IAM OIDC identity provider for your EKS cluster. This is a one-time action per cluster that allows IAM to trust authentication tokens from your EKS cluster, which is essential for IRSA.
2. **Create an IAM Role and Policy**: Define an IAM policy that specifies the necessary permissions for your pod and an IAM role that the pod can assume.
   1. **Create the IAM Policy**: This policy dictates the actions the role can perform on specific resources, such as an S3 bucket.
   2. **Create the IAM Role**: Link this IAM role to the required Kubernetes service account via a trust policy.

## Deploy the Defender

1. **Prisma Cloud Console Access**: Log in to your Prisma Cloud Console and confirm that the AWS account where the EKS cluster resides is ready and accessible.
2. **Select EKS Fargate Defender Type**: In the Prisma Cloud Console, go to the defender deployment section to get the necessary instrumentation logic.
   1. Go to **Manage > Defenders > Defenders: Deployed**.
   2. Select **Manual deploy**.
   3. On the **Basic Settings** tab:
      1. Select **Single Defender** as the deployment method.
      2. Select **Container Defender App-Embedded** as the defender type.
      3. Select **EKS Fargate** as the deployment type.
3. **Generate the protected deployment YAML**: Submit a valid EKS Fargate deployment YAML to the Prisma Cloud Console. The console modifies this YAML to include the Defender’s init container and other essential settings.
   1. Enter a valid EKS Fargate deployment YAML in **Insert deployment definition**.

      For more information about Kubernetes deployment YAML, see <https://kubernetes.io/docs/concepts/workloads/controllers/deployment/>.
   2. Click **Generate protected deployment definition**.
   3. The output is displayed in **Generated deployment definition**. Copy the YAML generated by Prisma Cloud Console for deployment in your EKS cluster.
4. **Apply the generated YAML to the cluster**: After the console processes your original YAML file, it will return a modified version that includes the Defender instrumentation.
   1. Save the YAML generated by the Prisma Cloud Console to a file (for example, `defended-deployment.yaml`).
   2. Apply this YAML file to your EKS cluster by running the following command: `kubectl apply -f defended-deployment.yaml`.
   3. This action schedules the pod to run on a Fargate node.

## Validate Defender Visibility

The app-embedded defender is an init container that executes and terminates upon completion. You can verify the successful deployment of the defender and its visibility in both your EKS cluster and the Prisma Cloud Console using the following steps.

* **In the Cluster**:
  1. To verify that the pod is running, run: `kubectl get pods`.
  2. To describe the pod and confirm the presence of the `twistlock-defender` init container and the injected environment variables, run: `kubectl describe pod <your-pod-name>`.
* **In the Prisma Cloud Console**:
  1. Go to **Radar > Defenders > Deployed defenders**.
  2. Filter the view to locate your new Defender. It will be uniquely identified by a combination of its OIDC Issuer URL, Pod UID, and container name.

## Run Cloud Discovery

Run a cloud discovery scan to ensure the Prisma Cloud Console accurately correlates the running Defender with the discovered EKS container entity.

1. In the Prisma Cloud Console, manually initiate a cloud discovery scan for the relevant AWS account.
2. When the scan is complete, go to the **Radar** view.
3. Locate the **aws-eks-container** asset for your deployment and confirm its status is **Defended**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/app-embedded/deploy-app-embedded-aws-fargate-amazon-eks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.