AWS eks documentation change
Summary
Updated documentation to add EKS Pod Identities as a recommended method for IAM permissions alongside existing IAM roles for service accounts (IRSA). Added separate configuration instructions for both methods across eksctl, console, and CLI implementations.
Security assessment
The changes document security-related IAM permission management improvements (EKS Pod Identities) but do not address a specific disclosed vulnerability. The updates provide guidance for implementing security features rather than patching a security issue.
Diff
diff --git a/eks/latest/userguide/efs-csi.md b/eks/latest/userguide/efs-csi.md index 2fab4a3fb..ce7f10ff4 100644 --- a/eks/latest/userguide/efs-csi.md +++ b/eks/latest/userguide/efs-csi.md @@ -38 +38,5 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t - * An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster. To determine whether you already have one, or to create one, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). + * The Amazon EFS CSI driver needs AWS Identity and Access Management (IAM) permissions. + + * AWS suggests using EKS Pod Identities. For more information, see [Overview of setting up EKS Pod Identities](./pod-identities.html#pod-id-setup-overview). + + * For information about IAM roles for service accounts and setting up an IAM OpenID Connect (OIDC) provider for your cluster, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). @@ -70 +74,18 @@ The specific steps in this procedure are written for using the driver as an Amaz -Run the following commands to create an IAM role with `eksctl`. Replace `my-cluster` with your cluster name and `AmazonEKS_EFS_CSI_DriverRole` with the name for your role. +#### If using Pod Identities + +Run the following commands to create an IAM role and Pod Identity association with `eksctl`. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. + + + export cluster_name=my-cluster + export role_name=AmazonEKS_EFS_CSI_DriverRole + eksctl create podidentityassociation \ + --service-account-name efs-csi-controller-sa \ + --namespace kube-system \ + --cluster $cluster_name \ + --role-name $role_name \ + --permission-policy-arns arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy \ + --approve + +#### If using IAM roles for service accounts + +Run the following commands to create an IAM role with `eksctl`. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. @@ -98,0 +120,12 @@ Run the following to create an IAM role with AWS Management Console. + 1. If using EKS Pod Identities: + + 1. In the **Trusted entity type** section, choose **AWS service**. + + 2. In the **Service or use case** drop down, choose **EKS**. + + 3. In the **Use case** section, choose **EKS - Pod Identity**. + + 4. Choose **Next**. + + 2. If using IAM roles for service accounts: + @@ -123 +156,13 @@ Run the following to create an IAM role with AWS Management Console. - 7. After the role is created, choose the role in the console to open it for editing. + 7. After the role is created: + + 1. If using EKS Pod Identities: + + 1. Open the [Amazon EKS console](https://console.aws.amazon.com/eks/home#/clusters). + + 2. In the left navigation pane, select **Clusters** , and then select the name of the cluster that you want to configure the EKS Pod Identity association for. + + 3. Choose the **Access** tab. + + 4. In **Pod Identity associations** , choose **Create**. + + 5. Choose the **IAM role** dropdown and select your newly created role. @@ -125 +170 @@ Run the following to create an IAM role with AWS Management Console. - 8. Choose the **Trust relationships** tab, and then choose **Edit trust policy**. + 6. Choose the **Kubernetes namespace** field and input `kube-system`. @@ -127 +172 @@ Run the following to create an IAM role with AWS Management Console. - 9. Find the line that looks similar to the following line: + 7. Choose the **Kubernetes service account** field and input `efs-csi-controller-sa`. @@ -129 +174 @@ Run the following to create an IAM role with AWS Management Console. - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com" + 8. Choose **Create**. @@ -131 +176 @@ Run the following to create an IAM role with AWS Management Console. -Add the following line above the previous line. Replace `region-code` with the AWS Region that your cluster is in. Replace `EXAMPLED539D4633E53DE1B71EXAMPLE` with your cluster’s OIDC provider ID. + 9. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). @@ -133 +178 @@ Add the following line above the previous line. Replace `region-code` with the A - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:efs-csi-*", + 2. If using IAM roles for service accounts: @@ -135 +180 @@ Add the following line above the previous line. Replace `region-code` with the A - 10. Modify the `Condition` operator from `"StringEquals"` to `"StringLike"`. + 1. Choose the role to open it for editing. @@ -137 +182,13 @@ Add the following line above the previous line. Replace `region-code` with the A - 11. Choose **Update policy** to finish. + 2. Choose the **Trust relationships** tab, and then choose **Edit trust policy**. + + 3. Find the line that looks similar to the following line: + + "oidc.eks.region-code.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:aud": "sts.amazonaws.com" + +Add the following line above the previous line. Replace `<region-code>` with the AWS Region that your cluster is in. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` with your cluster’s OIDC provider ID. + + "oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:sub": "system:serviceaccount:kube-system:efs-csi-*", + + 4. Modify the `Condition` operator from `"StringEquals"` to `"StringLike"`. + + 5. Choose **Update policy** to finish. @@ -146 +203,5 @@ Run the following commands to create an IAM role with AWS CLI. - 1. View your cluster’s OIDC provider URL. Replace `my-cluster` with your cluster name. If the output from the command is `None`, review the **Prerequisites**. +#### If using Pod Identities + + 1. Create the IAM role that grants the `AssumeRole` and `TagSession` actions to the `pods.eks.amazonaws.com` service. + + 1. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy-pod-identity.json`. @@ -148 +209,47 @@ Run the following commands to create an IAM role with AWS CLI. - aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowEksAuthToAssumeRoleForPodIdentity", + "Effect": "Allow", + "Principal": { + "Service": "pods.eks.amazonaws.com" + }, + "Action": [ + "sts:AssumeRole", + "sts:TagSession" + ] + } + ] + } + + 2. Create the role. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. + + export cluster_name=my-cluster + export role_name=AmazonEKS_EFS_CSI_DriverRole + aws iam create-role \ + --role-name $role_name \ + --assume-role-policy-document file://"aws-efs-csi-driver-trust-policy-pod-identity.json" + + 2. Attach the required AWS managed policy to the role with the following command. + + aws iam attach-role-policy \ + --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy \ + --role-name $role_name + + 3. Run the following command to create the Pod Identity association. Replace ` arn:aws:iam::<111122223333>:role/my-role` with the role created in previous steps. + + aws eks create-pod-identity-association --cluster-name $cluster_name --role-arn {arn-aws}iam::<111122223333>:role/my-role --namespace kube-system --service-account efs-csi-controller-sa + + 4. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). + + + + +#### If using IAM roles for service accounts + + 1. View your cluster’s OIDC provider URL. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. + + export cluster_name=my-cluster + export role_name=AmazonEKS_EFS_CSI_DriverRole + aws eks describe-cluster --name $cluster_name --query "cluster.identity.oidc.issuer" --output text @@ -152 +259,3 @@ An example output is as follows. - https://oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE + https://oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE> + +If the output from the command is `None`, review the **Prerequisites**. @@ -156 +265 @@ An example output is as follows. - 1. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy.json`. Replace `111122223333` with your account ID. Replace `EXAMPLED539D4633E53DE1B71EXAMPLE` and `region-code` with the values returned in the previous step. + 1. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy.json`. Replace `<111122223333>` with your account ID. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` and `<region-code>` with the values returned in the previous step. @@ -164 +273 @@ An example output is as follows. - "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE" + "Federated": "arn:aws:iam::<111122223333>:oidc-provider/oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>" @@ -169,2 +278,2 @@ An example output is as follows. - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:efs-csi-*", - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com" + "oidc.eks.region-code.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:sub": "system:serviceaccount:kube-system:efs-csi-*", + "oidc.eks.region-code.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:aud": "sts.amazonaws.com" @@ -177 +286 @@ An example output is as follows. - 2. Create the role. You can change `AmazonEKS_EFS_CSI_DriverRole` to a different name, but if you do, make sure to change it in later steps too. + 2. Create the role. @@ -180 +289 @@ An example output is as follows. - --role-name AmazonEKS_EFS_CSI_DriverRole \ + --role-name $role_name \ @@ -187 +296 @@ An example output is as follows. - --role-name AmazonEKS_EFS_CSI_DriverRole + --role-name $role_name