```$ kubectl n agent logs prefect job 2d655498 sqqlc 2020 12

Question

```$ kubectl n agent logs prefect job 2d655498 sqqlc 2020 12 14 20 20 37+0000 INFO prefect S3 | Downloading slow flow 2020 12 07t12 16 09 863598 00 00 from lime prefect Unable to locate credentials Traceback most recent call last File usr local bin prefect line 8 in lt module gt sys exit cli File usr local lib python3 8 site packages click core py line 829 in call return self main args kwargs File usr local lib python3 8 site packages click core py line 782 in main rv = self invoke ctx File usr local lib python3 8 site packages click core py line 1259 in invoke return process result sub ctx command invoke sub ctx File usr local lib python3 8 site packages click core py line 1259 in invoke return process result sub ctx command invoke sub ctx File usr local lib python3 8 site packages click core py line 1066 in invoke return ctx invoke self callback ctx params File usr local lib python3 8 site packages click core py line 610 in invoke return callback args kwargs File usr local lib python3 8 site packages prefect cli execute py line 34 in flow run return execute flow run File usr local lib python3 8 site packages prefect cli execute py line 99 in execute flow run raise exc File usr local lib python3 8 site packages prefect cli execute py line 84 in execute flow run flow = storage get flow storage flows flow data name File usr local lib python3 8 site packages prefect environments storage s3 py line 105 in get flow self boto3 client download fileobj File usr local lib python3 8 site packages boto3 s3 inject py line 678 in download fileobj return future result File usr local lib python3 8 site packages s3transfer futures py line 106 in result return self coordinator result File usr local lib python3 8 site packages s3transfer futures py line 265 in result raise self exception File usr local lib python3 8 site packages s3transfer tasks py line 255 in main self submit transfer future=transfer future kwargs File usr local lib python3 8 site packages s3transfer download py line 340 in submit response = client head object File usr local lib python3 8 site packages botocore client py line 357 in api call return self make api call operation name kwargs File usr local lib python3 8 site packages botocore client py line 662 in make api call http parsed response = self make request File usr local lib python3 8 site packages botocore client py line 682 in make request return self endpoint make request operation model request dict File usr local lib python3 8 site packages botocore endpoint py line 102 in make request return self send request request dict operation model File usr local lib python3 8 site packages botocore endpoint py line 132 in send request request = self create request request dict operation model File usr local lib python3 8 site packages botocore endpoint py line 115 in create request self event emitter emit event name request=request File usr local lib python3 8 site packages botocore hooks py line 356 in emit return self emitter emit aliased event name kwargs File usr local lib python3 8 site packages botocore hooks py line 228 in emit return self emit event name kwargs File usr local lib python3 8 site packages botocore hooks py line 211 in emit response = handler kwargs File usr local lib python3 8 site packages botocore signers py line 90 in handler return self sign operation name request File usr local lib python3 8 site packages botocore signers py line 162 in sign auth add auth request File usr local lib python3 8 site packages botocore auth py line 357 in add auth raise NoCredentialsError botocore exceptions NoCredentialsError Unable to locate credentials``` Anyone who managed to make EKS Fargate work with prefect agents

Levi Leal · Answer

I ve already tried to add the policy <https console aws amazon com iam home policies arn 3Aaws 3Aiam 3A 3Aaws 3Apolicy 2FAmazonS3FullAccess|AmazonS3FullAccess> on the Cluster Service Role but it didn t work My desired solution would be something that avoids storing credentials But it could be a last resort

Kyle Moon-Wright · Answer

Hey < Levi Leal> From the traceback it looks like your FargateAgent is having trouble retrieving your flow code from S3 without If these aren t provided the Agent will look to environment variables to authenticate with boto3 which can alternatively be provided by utilizing your secrets manager of choice Is this an option for your setup How did you provide your flow code from S3 previously As a sidenote the FargateAgent is now deprecated for the for continued functionality this was very recent but is still viable

Levi Leal · Answer

I m using the Kubernetes Agent I have EKS Amazon Kubernetes with a Fargate profile The agent is deployed normaly but the job that tries to download the flow doesn t have access I ve tried to add S3 access to all roles on the cluster but still doesn t work

Kyle Moon-Wright · Answer

Hmm that s a tough one to debug This <https docs prefect io orchestration agents kubernetes html additional permissions|blurb> was the only bit I could find but I think you ve already done this configuration ```To enable S3 access by your kubernetes cluster on EKS add the necessary permissions AmazonS3FullAccess or AmazonS3ReadOnlyAccess directly to the NodeInstanceRole used by aws auth cm yaml after launching worker nodes and before applying aws auth cm yaml with kubectl ```

Levi Leal · Answer

This is my current EKS compute config I already did this one but it only works when I don t have the `fp agent` profile as the jobs will be deployed to the Node Group

Levi Leal · Answer

When I create the profile my agents and jobs are created by fargate I created a IAM Role with S3 access policy and attached it to my Fargate Profile I know the agents can connect to the pods on the nodegroup because I m using a cluster local DNS on the agent and it is able to query new scheduled flows But when the agent creates a new job on fargate this job can t access S3