AWS eks documentation change
Summary
Added Cert Manager/External DNS documentation and fixed typos
Security assessment
Added security-relevant IAM permission guidance for External DNS (least privilege principles) but no evidence of addressing existing vulnerabilities. Primarily documents security best practices.
Diff
diff --git a/eks/latest/userguide/community-addons.md b/eks/latest/userguide/community-addons.md index 0a8c88fde..d4ff1be8e 100644 --- a/eks/latest/userguide/community-addons.md +++ b/eks/latest/userguide/community-addons.md @@ -66 +66 @@ You install or update community add-ons in the same way as other Amazon EKS Add- -The following community add-ons are availalbe from Amazon EKS. +The following community add-ons are available from Amazon EKS. @@ -108,0 +109,28 @@ Custom IAM permissions | None +### Cert Manager + +Cert Manager can be used to manage the creation and renewal of certificates. + +Property | Value +---|--- +Add-on name | `cert-manager` +Namespace | `cert-manager` +Documentation | [Cert Manager Docs](https://cert-manager.io/docs/) +Service account name | None +Managed IAM policy | None +Custom IAM permissions | None + +### External DNS + +The External DNS EKS add-on can be used to manage Route53 DNS records through Kubernetes resources. + +External DNS permissions can be reduced to `route53:ChangeResourceRecordSets`, `route53:ListHostedZones`, and `route53:ListResourceRecordSets` on the hosted zones you wish to manage. + +Property | Value +---|--- +Add-on name | `external-dns` +Namespace | `external-dns` +Documentation | [GitHub Readme](https://github.com/kubernetes-sigs/external-dns) +Service account name | external-dns +Managed IAM policy | `arn:aws:iam::aws:policy/AmazonRoute53FullAccess` +Custom IAM permissions | None + @@ -111 +139 @@ Custom IAM permissions | None -You can download the open source attribtions and license information for community add-ons. +You can download the open source attributions and license information for community add-ons.