manage_k8s_resource

// WHEN AI AGENTS USE THIS TOOL

AI agents use manage_k8s_resource to create or modify resources in Amazon EKS MCP Server. Write operations carry medium risk because an autonomous agent could trigger bulk unintended modifications. Rate limits prevent a single agent session from making hundreds of changes in rapid succession. Argument validation ensures the agent passes expected values.

// WHY ENFORCE A POLICY ON MANAGE_K8S_RESOURCE

Without a policy, an AI agent could call manage_k8s_resource repeatedly, creating or modifying resources faster than any human could review. Intercept's rate limiting ensures write operations happen at a controlled pace, and argument validation catches malformed or unexpected inputs before they reach Amazon EKS MCP Server.

// RECOMMENDED POLICY

Write tools can modify data. A rate limit prevents runaway bulk operations from AI agents.

amazon-eks-mcp-server.yaml

tools:
  manage_k8s_resource:
    rules:
      - action: allow
        rate_limit:
          max: 30
          window: 60

See the full Amazon EKS MCP Server policy for all 16 tools.

// DETAILS

Tool Name manage_k8s_resource

Category Write

MCP Server Amazon EKS MCP Server MCP Server

Risk Level Medium

// MORE AMAZON EKS MCP SERVER TOOLS

Write add_inline_policy Write apply_yaml Write generate_app_manifest Write manage_eks_stacks Read get_cloudwatch_logs Read get_cloudwatch_metrics Read get_eks_insights Read get_eks_metrics_guidance

View all 16 tools →

// WHAT CAN GO WRONG

Agents calling write-class tools like manage_k8s_resource have been implicated in these attack patterns. Read the full case and prevention policy for each:

Browse the full MCP Attack Database →

// OTHER WRITE TOOLS ACROSS MCP SERVERS

Other tools in the Write risk category across the catalogue. The same policy patterns (rate-limit, validate) apply to each.

Firecrawl Web Scraping Server firecrawl_generate_llmstxt AbraFlexi contact_create AbraFlexi contact_update AbraFlexi evidence_create AbraFlexi evidence_update AbraFlexi invoice_issued_update

// RELATED READING

// FAQ

What does the manage_k8s_resource tool do? +

Manage a single Kubernetes resource with various operations. This tool provides complete CRUD (Create, Read, Update, Delete) operations for Kubernetes resources in an EKS cluster. It supports all resource types and allows for precise control over individual resources, enabling you to create custom resources, update specific fields, read detailed information, and delete resources that are no longer needed. IMPORTANT: Use this tool instead of 'kubectl create', 'kubectl edit', 'kubectl patch', 'kubectl delete', or 'kubectl get' commands. ## Requirements - The server must be run with the `--allow-write` flag for mutating operations - The server must be run with the `--allow-sensitive-data-access` flag for Secret resources - The EKS cluster must exist and be accessible ## Operations - **create**: Create a new resource with the provided definition - **replace**: Replace an existing resource with a new definition - **patch**: Update specific fields of an existing resource - **delete**: Remove an existing resource - **read**: Get details of an existing resource ## Usage Tips - Use list_api_versions to find available API versions - For namespaced resources, always provide the namespace - When creating resources, ensure the name in the body matches the name parameter - For patch operations, only include the fields you want to update Args: ctx: MCP context operation: Operation to perform (create, replace, patch, delete, read) cluster_name: Name of the EKS cluster kind: Kind of the Kubernetes resource (e.g., 'Pod', 'Service') api_version: API version of the Kubernetes resource (e.g., 'v1', 'apps/v1') name: Name of the Kubernetes resource namespace: Namespace of the Kubernetes resource (optional) body: Resource definition Returns: KubernetesResourceResponse with operation result. It is categorised as a Write tool in the Amazon EKS MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on manage_k8s_resource? +

Add a rule in your Intercept YAML policy under the tools section for manage_k8s_resource. You can allow, deny, rate-limit, or validate arguments. Then run Intercept as a proxy in front of the Amazon EKS MCP Server MCP server.

What risk level is manage_k8s_resource? +

manage_k8s_resource is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit manage_k8s_resource? +

Yes. Add a rate_limit block to the manage_k8s_resource rule in your Intercept policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block manage_k8s_resource completely? +

Set action: deny in the Intercept policy for manage_k8s_resource. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides manage_k8s_resource? +

manage_k8s_resource is provided by the Amazon EKS MCP Server MCP server (awslabs.eks-mcp-server). Intercept sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Let agents act without letting them run wild.