AWS eks documentation change
Summary
Updated documentation for enabling IAM roles for service accounts in EKS, including version requirement update for eksctl, formatting changes for cluster name variable, step number corrections, and clarification on VPC endpoint limitations with OIDC provider creation
Security assessment
The changes are primarily documentation improvements and clarifications about the process of creating IAM OIDC providers. While IAM roles and OIDC are security-related features, these specific changes do not address any security vulnerabilities or add new security documentation.
Diff
diff --git a/eks/latest/userguide/enable-iam-roles-for-service-accounts.md index a5fcf2fd6..f8ec972c5 100644 --- a/eks/latest/userguide/enable-iam-roles-for-service-accounts.md +++ b/eks/latest/userguide/enable-iam-roles-for-service-accounts.md @@ -30 +30 @@ You can create an IAM OIDC provider for your cluster using `eksctl` or the AWS M - 1. Version `0.204.0` or later of the `eksctl` command line tool installed on your device or AWS CloudShell. To install or update `eksctl`, see [Installation](https://eksctl.io/installation) in the `eksctl` documentation. + 1. Version `0.205.0` or later of the `eksctl` command line tool installed on your device or AWS CloudShell. To install or update `eksctl`, see [Installation](https://eksctl.io/installation) in the `eksctl` documentation. @@ -34,7 +34 @@ You can create an IAM OIDC provider for your cluster using `eksctl` or the AWS M -Retrieve your cluster’s OIDC issuer ID and store it in a variable. Replace `my-cluster` with your own value. - - cluster_name=my-cluster - - - - +Retrieve your cluster’s OIDC issuer ID and store it in a variable. Replace `<my-cluster>` with your own value. @@ -41,0 +36 @@ Retrieve your cluster’s OIDC issuer ID and store it in a variable. Replace `my + cluster_name=<my-cluster> @@ -47 +40 @@ Retrieve your cluster’s OIDC issuer ID and store it in a variable. Replace `my - 1. Determine whether an IAM OIDC provider with your cluster’s issuer ID is already in your account. + 3. Determine whether an IAM OIDC provider with your cluster’s issuer ID is already in your account. @@ -53 +46 @@ If output is returned, then you already have an IAM OIDC provider for your clust - 2. Create an IAM OIDC identity provider for your cluster with the following command. + 4. Create an IAM OIDC identity provider for your cluster with the following command. @@ -59,2 +52 @@ If output is returned, then you already have an IAM OIDC provider for your clust -If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be accessed from inside that VPC. Consequently, your operations such as creating an OIDC provider with `eksctl` in the VPC will not work and will result in a timeout when attempting to request ` [https://oidc.eks](https://oidc.eks).`region`.amazonaws.com`. An example error message follows: - +If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be accessed from inside that VPC. Consequently, your operations such as creating an OIDC provider with `eksctl` in the VPC will not work and will result in a timeout. An example error message follows: @@ -61,0 +54 @@ If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be + ** server cant find oidc.eks.<region-code>.amazonaws.com: NXDOMAIN @@ -62,0 +56 @@ If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be +To complete this step, you can run the command outside the VPC, for example in AWS CloudShell or on a computer connected to the internet. Alternatively, you can create a split-horizon conditional resolver in the VPC, such as Route 53 Resolver to use a different resolver for the OIDC Issuer URL and not use the VPC DNS for it. For an example of conditional forwarding in CoreDNS, see the [Amazon EKS feature request](https://github.com/aws/containers-roadmap/issues/2038) on GitHub. @@ -65 +58,0 @@ If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be - ** server cant find oidc.eks.region.amazonaws.com: NXDOMAIN @@ -67 +59,0 @@ If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be -To complete this step, you can run the command outside the VPC, for example in AWS CloudShell or on a computer connected to the internet. Alternatively, you can create a split-horizon conditional resolver in the VPC, such as Route 53 Resolver to use a different resolver for the OIDC Issuer URL and not use the VPC DNS for it. For an example of conditional forwarding in CoreDNS, see the [Amazon EKS feature request](https://github.com/aws/containers-roadmap/issues/2038) on GitHub.