AWS eks documentation change
Summary
Restructured and expanded documentation to introduce EKS Auto Mode, reorganize feature sections (management interfaces, access control, compute, storage), add related services list, and emphasize security integrations like IAM and GuardDuty. Removed standalone sections about ML, hybrid deployments, and add-ons.
Security assessment
Added explicit documentation about IAM-based access control, security best practices links, and integration with GuardDuty for threat detection. However, there is no evidence these changes address a specific security vulnerability or incident.
Diff
diff --git a/eks/latest/userguide/what-is-eks.md b/eks/latest/userguide/what-is-eks.md index 6f2343853..d40933305 100644 --- a/eks/latest/userguide/what-is-eks.md +++ b/eks/latest/userguide/what-is-eks.md @@ -5 +5 @@ -Features of Amazon EKSAmazon EKS Pricing +Features of Amazon EKSRelated servicesAmazon EKS Pricing @@ -13 +13,16 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service that eliminates the need to operate and maintain the availability and scalability of Kubernetes clusters in Amazon Web Services (AWS) and in your own data centers. [Kubernetes](https://kubernetes.io/docs/concepts/overview/) is an open source system that automates the management, scaling, and deployment of containerized applications. To get started, see the [Quickstart: Deploy a web app and store data](./quickstart.html) page in the Amazon EKS User Guide. +Amazon Elastic Kubernetes Service (Amazon EKS) is the premiere platform for running [Kubernetes](https://kubernetes.io/docs/concepts/overview/) clusters, both in the Amazon Web Services (AWS) cloud and in your own data centers ([EKS Anywhere](https://anywhere.eks.amazonaws.com/) and [Amazon EKS Hybrid Nodes](./hybrid-nodes-overview.html)). + +Amazon EKS simplifies building, securing, and maintaining Kubernetes clusters. It can be more cost effective at providing enough resources to meet peak demand than maintaining your own data centers. Two of the main approaches to using Amazon EKS are as follows: + + * **EKS standard** : AWS manages the [Kubernetes control plane](https://kubernetes.io/docs/concepts/overview/components/#control-plane-components) when you create a cluster with EKS. Components that manage nodes, schedule workloads, integrate with the AWS cloud, and store and scale control plane information to keep your clusters up and running, are handled for you automatically. + + * **EKS Auto Mode** : Using the [EKS Auto Mode](./automode.html) feature, EKS extends its control to manage [Nodes](https://kubernetes.io/docs/concepts/overview/components/#node-components) (Kubernetes data plane) as well. It simplifies Kubernetes management by automatically provisioning infrastructure, selecting optimal compute instances, dynamically scaling resources, continuously optimizing costs, patching operating systems, and integrating with AWS security services. + + + + +The following diagram illustrates how Amazon EKS integrates your Kubernetes clusters with the AWS cloud, depending on which method of cluster creation you choose: + + + +Amazon EKS helps you accelerate time to production, improve performance, availability and resiliency, and enhance system security. For more information, see [Amazon Elastic Kubernetes Service](https://aws.amazon.com/eks/). @@ -17 +32 @@ Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service t -**Fully Managed Kubernetes** +Amazon EKS provides the following high-level features: @@ -19 +34 @@ Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service t -Amazon EKS provides a scalable and highly-available Kubernetes control plane running across multiple AWS Availability Zones (AZs). Amazon EKS automatically manages availability and scalability of Kubernetes API servers and etcd persistence layer. Amazon EKS runs the Kubernetes control plane across multiple AZs to ensure high availability, and automatically detects and replaces unhealthy control plane nodes. +**Management interfaces** @@ -21 +35,0 @@ Amazon EKS provides a scalable and highly-available Kubernetes control plane run -Amazon EKS Auto Mode fully automates Kubernetes cluster infrastructure management for compute, storage, and networking on AWS. It simplifies Kubernetes management by automatically provisioning infrastructure, selecting optimal compute instances, dynamically scaling resources, continuously optimizing costs, patching operating systems, and integrating with AWS security services. @@ -23 +37 @@ Amazon EKS Auto Mode fully automates Kubernetes cluster infrastructure managemen -**Kubernetes Compatibility and Support** +EKS offers multiple interfaces to provision, manage, and maintain clusters, including AWS Management Console, Amazon EKS API/SDKs, CDK, AWS CLI, eksctl CLI, AWS CloudFormation, and Terraform. For more information, see [Get started with Amazon EKS](./getting-started.html) and [Organize workloads with Amazon EKS clusters](./clusters.html). @@ -25 +39 @@ Amazon EKS Auto Mode fully automates Kubernetes cluster infrastructure managemen -Amazon EKS runs upstream Kubernetes and is certified Kubernetes-conformant, so you can use all the existing plug-ins and tooling from the Kubernetes community. Applications running on Amazon EKS are fully compatible with applications running on any standard Kubernetes environment, whether running in on-premises data centers or public clouds. This means that you can easily migrate any standard Kubernetes application to Amazon EKS without refactoring your code. Amazon EKS supports Kubernetes versions longer than they are supported upstream, with standard support for Kubernetes minor versions for 14 months from the time they are released in Amazon EKS, and extended support for Kubernetes minor versions for an additional 12 months of support (26 total months per version). See [Understand the Kubernetes version lifecycle on EKS](./kubernetes-versions.html) for more information. +**Access control tools** @@ -27 +40,0 @@ Amazon EKS runs upstream Kubernetes and is certified Kubernetes-conformant, so y -**Machine Learning** @@ -29 +42 @@ Amazon EKS runs upstream Kubernetes and is certified Kubernetes-conformant, so y -Amazon EKS has become a cornerstone for deploying and managing AI/ML workloads in the cloud. With its ability to handle complex, resource-intensive tasks, Amazon EKS provides a scalable and flexible foundation for running AI/ML models, making it an ideal choice for organizations aiming to harness the full potential of machine learning. Whether you’re training large language models that require vast amounts of compute power or deploying inference pipelines that need to handle unpredictable traffic patterns, Amazon EKS scales up and down efficiently, optimizing resource use and cost. Amazon EKS supports a wide range of compute options including GPU-powered instances and AWS Neuron, allowing for high-performance training and low-latency inference, ensuring that models run efficiently in production environments. For more information, see [Overview of Machine Learning on Amazon EKS](./machine-learning-on-eks.html). +EKS relies on both Kubernetes and AWS Identity and Access Management (AWS IAM) features to [manage access](./cluster-auth.html) from users and workloads. For more information, see [Grant IAM users and roles access to Kubernetes APIs](./grant-k8s-access.html) and [Grant Kubernetes workloads access to AWS using Kubernetes Service Accounts](./service-accounts.html). @@ -31 +44 @@ Amazon EKS has become a cornerstone for deploying and managing AI/ML workloads i -**Hybrid Deployments** +**Compute resources** @@ -33 +45,0 @@ Amazon EKS has become a cornerstone for deploying and managing AI/ML workloads i -You can use the same Amazon EKS clusters to run nodes on AWS-hosted infrastructure in AWS [Regions](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/), [AWS Local Zones](https://aws.amazon.com/about-aws/global-infrastructure/localzones/), [AWS Wavelength Zones](https://aws.amazon.com/wavelength/), or in your own on-premises environments with [AWS Outposts](https://aws.amazon.com/outposts/) and [Amazon EKS Hybrid Nodes](./hybrid-nodes-overview.html). AWS Outposts is AWS-managed infrastructure that you run in your data centers or co-location facilities, whereas Amazon EKS Hybrid Nodes runs on virtual machines or bare metal infrastructure that you manage in your on-premises or edge environments. If you need to run in isolated or air-gapped environments, you can use [Amazon EKS Anywhere](https://aws.amazon.com/eks/eks-anywhere/), which is AWS-supported Kubernetes management software that runs on infrastructure you manage. With Amazon EKS Anywhere, you are responsible for cluster lifecycle operations and maintenance of your Amazon EKS Anywhere clusters. The _Amazon EKS Connector_ can be used to view any Kubernetes cluster and their resources in the Amazon EKS console. _Amazon EKS Distro_ is the AWS distribution of the underlying Kubernetes components that power all Amazon EKS offerings. @@ -35 +47 @@ You can use the same Amazon EKS clusters to run nodes on AWS-hosted infrastructu -**Compute** +For [compute resources](./eks-compute.html), EKS allows the full range of Amazon EC2 instance types and AWS innovations such as Nitro and Graviton with Amazon EKS for you to optimize the compute for your workloads. For more information, see [Manage compute resources by using nodes](./eks-compute.html). @@ -37 +49 @@ You can use the same Amazon EKS clusters to run nodes on AWS-hosted infrastructu -You can use the full range of Amazon EC2 instance types and AWS innovations such as Nitro and Graviton with Amazon EKS for you to optimize the compute for your workloads. You can use on-demand or Spot instances and your savings plans with compute you use with your Amazon EKS clusters. See [Manage compute resources by using nodes](./eks-compute.html) for more information. +**Storage** @@ -39 +50,0 @@ You can use the full range of Amazon EC2 instance types and AWS innovations such -**Networking** @@ -41 +52 @@ You can use the full range of Amazon EC2 instance types and AWS innovations such -Amazon EKS integrates with Amazon VPC allowing you to use your own Amazon VPC security groups and [network access control lists](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls) (ACLs) with Amazon EKS clusters. Amazon EKS provides the [Amazon VPC container network interface](https://github.com/aws/amazon-vpc-cni-k8s) (CNI), allowing Kubernetes pods to receive IP addresses directly from the VPC. Amazon EKS supports IPv4 and IPv6 for workloads and dual-stack endpoints for the Amazon EKS APIs and Kubernetes API. You can use Application Load Balancers (ALB) and Network Load Balancers (NLB) managed by the AWS Load Balancer Controller for application ingress and load balancing. You can also use Amazon VPC Lattice, a managed application networking service built directly into the AWS networking infrastructure, for cross-cluster connectivity with standard Kubernetes semantics in a simple and consistent manner. See [Configure networking for Amazon EKS clusters](./eks-networking.html) for more information. +EKS Auto Mode automatically creates storage classes using [EBS volumes](./create-storage-class.html). Using Container Storage Interface (CSI) drivers, you can also use Amazon S3, Amazon EFS, Amazon FSX, and Amazon File Cache for your application storage needs. For more inforamtion, see [Store application data for your cluster](./storage.html). @@ -45 +55,0 @@ Amazon EKS integrates with Amazon VPC allowing you to use your own Amazon VPC se -Amazon EKS integrates with AWS Identity and Access Management (IAM) for you to secure your clusters and applications. Amazon EKS makes it easy to map AWS IAM permissions to Kubernetes Role Based Access Control (RBAC). You can use AWS IAM for cluster authentication and authorization with Amazon EKS Cluster Access Management, for access and permissions of operational software running on your clusters, and for granular application access to other AWS services with Amazon EKS Pod Identity. Amazon EKS is certified by multiple compliance programs for regulated and sensitive applications. Amazon EKS is compliant with [SOC](https://aws.amazon.com/compliance/soc-faqs/), [PCI](https://aws.amazon.com/compliance/pci-dss-level-1-faqs/), [ISO](https://aws.amazon.com/compliance/iso-certified/), [FedRAMP-Moderate](https://aws.amazon.com/compliance/fedramp/), [IRAP](https://aws.amazon.com/compliance/irap/), [C5](https://aws.amazon.com/compliance/bsi-c5/), [K-ISMS](https://aws.amazon.com/compliance/k-isms/), [ENS High](https://aws.amazon.com/compliance/esquema-nacional-de-seguridad/), [OSPAR](https://aws.amazon.com/compliance/OSPAR/), [HITRUST CSF](https://aws.amazon.com/compliance/hitrust/), and is a [HIPAA](https://aws.amazon.com/compliance/hipaa-compliance/) eligible service. See [Learn how access control works in Amazon EKS](./cluster-auth.html) for more information. @@ -47 +57 @@ Amazon EKS integrates with AWS Identity and Access Management (IAM) for you to s -**Observability** +The shared responsibility model is employed as it relates to [Security in Amazon EKS](./security.html). For more information, see [Security best practices](./security-best-practices.html), [Infrastructure security](./infrastructure-security.html), and [Kubernetes security](./security-k8s.html). @@ -49 +59 @@ Amazon EKS integrates with AWS Identity and Access Management (IAM) for you to s -Amazon EKS integrates with AWS Managed Service for Prometheus (AMP), Amazon CloudWatch, Amazon CloudTrail, and Amazon GuardDuty for monitoring, logging, and auditing capabilities. You can also view performance insights for your Amazon EKS clusters directly in the Amazon EKS console. You can use AMP agent-less scrapers or the AWS Distro for OpenTelemetry add-on to monitor and collect logs for your clusters, infrastructure, and applications. You can use Amazon CloudWatch Container Insights, the CloudWatch Observability Agent add-on, and Amazon EKS control plane logging to monitor, collect logs, and analyze issues with your clusters, infrastructure, and applications. Amazon EKS also integrates with Amazon CloudTrail for auditing cluster API activity, and Amazon GuardDuty for audit log threat analysis and runtime threat detection. See [Monitor your cluster performance and view logs](./eks-observe.html) for more information. +**Monitoring tools** @@ -51 +60,0 @@ Amazon EKS integrates with AWS Managed Service for Prometheus (AMP), Amazon Clou -**Storage** @@ -53 +62 @@ Amazon EKS integrates with AWS Managed Service for Prometheus (AMP), Amazon Clou -You can use a range of AWS storage services with Amazon EKS for the storage needs of your applications. Through an AWS-supported breadth of Container Storage Interface (CSI) drivers, you can easily use Amazon EBS, Amazon S3, Amazon EFS, Amazon FSX, and Amazon File Cache for the storage needs of your applications running on Amazon EKS. See [Store application data for your cluster](./storage.html) for more information. +Use the [observability dashboard](./observability-dashboard.html) to monitor Amazon EKS clusters. Monitoring tools include [Prometheus](./prometheus.html), [CloudWatch](./cloudwatch.html), [Cloudtrail](./logging-using-cloudtrail.html), and [ADOT Operator](./opentelemetry.html). For more information on dashboards, metrics servers, and other tools, see [EKS cluster costs](./cost-monitoring.html) and [Kubernetes Metrics Server](./metrics-server.html). @@ -55 +64 @@ You can use a range of AWS storage services with Amazon EKS for the storage need -**Add-ons** +**Kubernetes compatibility and support** @@ -57 +65,0 @@ You can use a range of AWS storage services with Amazon EKS for the storage need -Amazon EKS offers a curated set of AWS-vended Kubernetes software, also known as Amazon EKS add-ons, that provide key operational capabilities for Kubernetes clusters and integration with various AWS services for cluster and pod networking, load balancing, storage, observability, and security. Amazon EKS provides a unified management experience for finding, selecting, installing, managing, and configuring third-party Kubernetes operational software (add-ons) from independent software vendors on Amazon EKS clusters. See [Amazon EKS add-ons](./eks-add-ons.html) for more information. @@ -59 +67,14 @@ Amazon EKS offers a curated set of AWS-vended Kubernetes software, also known as -**Management interfaces** +Amazon EKS is certified Kubernetes-conformant, so you can deploy Kubernetes-compatible applications without refactoring and use Kubernetes community tooling and plugins. EKS offers both [standard support](./kubernetes-versions-standard.html) and [extended support](./kubernetes-versions-extended.html) for Kubernetes. For more information, see [Understand the Kubernetes version lifecycle on EKS](./kubernetes-versions.html). + +## Related services + +**Services to use with Amazon EKS** + +You can use other AWS services with the clusters that you deploy using Amazon EKS: + +**Amazon EC2** + + +Obtain on-demand, scalable compute capacity with [Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html). + +**Amazon EBS** @@ -61 +81,0 @@ Amazon EKS offers a curated set of AWS-vended Kubernetes software, also known as -Amazon EKS supports a range of interfaces to provision, manage, and maintain clusters including the Amazon EKS console, Amazon EKS API/SDKs, CDK, AWS CLI, eksctl CLI, AWS CloudFormation, and Terraform. You can also use AWS Controllers for Kubernetes (ACK) to provision and manage AWS services from within your Kubernetes environment using Kubernetes interfaces. ACK makes it simple to build scalable and highly available Kubernetes applications utilizing AWS services. See [Get started with Amazon EKS](./getting-started.html) for more information. @@ -63 +83 @@ Amazon EKS supports a range of interfaces to provision, manage, and maintain clu -**Operating systems** +Attach scalable, high-performance block storage resources with [Amazon EBS](https://docs.aws.amazon.com/ebs/latest/userguide/what-is-ebs.html). @@ -65 +85,29 @@ Amazon EKS supports a range of interfaces to provision, manage, and maintain clu -Amazon EKS supports a range of operating systems and you can use pre-built, Amazon EKS-optimized Amazon Machine Images (AMIs) for the base images of your compute nodes. Amazon EKS maintains optimized images for Amazon Linux 2, Amazon Linux 2023, Bottlerocket, Windows, and there are Ubuntu images maintained by Canonical. You can also use your own custom AMIs for other operating system variants. The Amazon EKS AMIs for Amazon Linux have built-in support for NVIDIA and AWS Neuron accelerated instance types. See [Create nodes with pre-built optimized images](./eks-optimized-amis.html) for more information. +**Amazon ECR** + + +Store container images securely with [Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html). + +**Amazon CloudWatch** + + +Monitor AWS resources and applications in real time with [Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html). + +**Amazon Prometheus** + + +Track metrics for containerized applications with [Amazon Managed Service for Prometheus](https://docs.aws.amazon.com/prometheus/latest/userguide/what-is-Amazon-Managed-Service-Prometheus.html). + +**Elastic Load Balancing** + + +Distribute incoming traffic across multiple targets with [Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html). + +**Amazon GuardDuty** + + +Detect threats to EKS clusters with [Amazon GuardDuty](./integration-guardduty.html). + +**AWS Resilience Hub** + + +Assess EKS cluster resiliency with [AWS Resilience Hub](./integration-resilience-hub.html). @@ -69 +117,5 @@ Amazon EKS supports a range of operating systems and you can use pre-built, Amaz -Amazon EKS has per cluster pricing based on Kubernetes cluster version support, pricing for Amazon EKS Auto Mode, and per vCPU pricing for Amazon EKS Hybrid Nodes. When using Amazon EKS, you pay separately for the AWS resources you use to run your applications on Kubernetes worker nodes. For example, if you are running Kubernetes worker nodes as Amazon EC2 instances with Amazon EBS volumes and public IPv4 addresses, you are charged for the instance capacity through Amazon EC2, the volume capacity through Amazon EBS, and the IPv4 address through Amazon VPC. Visit the respective pricing pages of the AWS services you are using with your Kubernetes applications for detailed pricing information. +Amazon EKS has per cluster pricing based on Kubernetes cluster version support, pricing for Amazon EKS Auto Mode, and per vCPU pricing for Amazon EKS Hybrid Nodes. + +When using Amazon EKS, you pay separately for the AWS resources you use to run your applications on Kubernetes worker nodes. For example, if you are running Kubernetes worker nodes as Amazon EC2 instances with Amazon EBS volumes and public IPv4 addresses, you are charged for the instance capacity through Amazon EC2, the volume capacity through Amazon EBS, and the IPv4 address through Amazon VPC. + +Visit the respective pricing pages of the AWS services you are using with your Kubernetes applications for detailed pricing information.