Cache AWS EKS Token

This is a script that is used to speed up kubectl when using AWS EKS. This works by caching the eks token from AWS. It's basically a wrapper around aws eks get-token that caches the token and reuses it if it's still valid. It's about ~1.67x faster than using aws cli directly. It's really noticeable in day to day use.

In the benchmark below, the cached run of kubectl get pods -n external-dns was ~1.67x quicker than the direct AWS CLI run, dropping from 561 ms to 337 ms.

The default way is to use aws eks get-token command, but it is not cached and it is not very fast. It's slow because:

1. Every kubectl command invokes the exec credential command, and aws eks get-token generates a new presigned token instead of reusing a valid one.
2. Starting the AWS CLI and loading credentials adds noticeable overhead. Credential loading may also involve the network when credentials need refreshing.

Here is a quick comparison before and after

Before	After

Benchmark

Measured on July 24, 2026, against an EKS cluster in eu-west-1 using AWS CLI 2.36.6, kubectl 1.36.3, and Hyperfine 1.20.0 on an arm64 Mac:

Operation	Direct AWS CLI	With cached token	Speedup
kubectl get pods -n external-dns	560.7 ms	336.7 ms	~1.67x

The benchmark used 5 sequential runs after 1 warmup run. Both paths were measured through kubectl, with command output discarded during timing.

Run benchmark.sh to reproduce the test.

How to use

1. Clone repo
2. cd into the repo and chmod +x cached-aws-eks-token.sh. Necessary as git clone removes the executable flag from files.
3. Simply replace the command: aws with command: ../cache-eks-token/cached-aws-eks-token.sh in your ~/.kube/config files.
   1. The command might differ based on where you placed the script.

Important

Remember to update your kubeconfig with the above script whenever you create a new kubeconfig or use aws eks update-kubeconfig to generate/update as it will replace it back with command: aws, wasting time in your life :)

How it works

This script caches the token generated by aws eks get-token in a file based on cluster name in the $HOME/.kube/cache directory. AWS issues token for at-most 15 mins. This script will check the expiry and return existing token if it's till valid. The token will be refreshed if it's expiring within 30 seconds.

Errors

1. Unable to connect to the server: getting credentials: exec: ... permission denied
   1. script needs to be executable, run chmod +x cached-aws-eks-token.sh
2. If error like Unable to connect to the server: getting credentials: ... no such file or directory
   1. Make sure to make the command path is relative to wherever the script exists. You can use ../ in the command to move up directories.
3. Failed conversion of ``'' using format ``%Y-%m-%dT%H:%M:%SZ''
   1. Happens when unable to get the date from the cache file. Try deleing the token cache files from $HOME/.kube/cache
   2. The cache file generated by the script should looks like this

      {
        "kind": "ExecCredential",
        "apiVersion": "client.authentication.k8s.io/v1beta1",
        "spec": {},
        "status": {
          "expirationTimestamp": "2025-07-20T17:38:15Z",
          "token": "k8s-aws-v1.<token>"
        }
      }

Dependencies

1. jq (brew install jq for macOS)