AWS eks documentation change
Summary
Added section about IMDSv2 enforcement with hop limit 1 by default in Auto Mode, including security considerations for pod access
Security assessment
Documents security best practices (IMDSv2 enforcement) but doesn't address a specific vulnerability. Adds guidance about securing metadata access.
Diff
diff --git a/eks/latest/userguide/automode-learn-instances.md b/eks/latest/userguide/automode-learn-instances.md index 60bfd2e09..9f9e00e0e 100644 --- a/eks/latest/userguide/automode-learn-instances.md +++ b/eks/latest/userguide/automode-learn-instances.md @@ -5 +5 @@ -Comparison tableEKS Auto Mode supported instance referenceConsiderations +Comparison tableEKS Auto Mode supported instance referenceInstance Metadata ServiceConsiderations @@ -51,0 +52,2 @@ With EKS Auto Mode, AWS determines the image (AMI) used for your compute nodes. +Generally, EKS releases a new AMI each week containing CVE and security fixes. + @@ -79,0 +82,25 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// +## Instance Metadata Service + + * EKS Auto Mode enforces IMDSv2 with a hop limit of 1 by default, adhering to AWS security best practices + + * This default configuration cannot be modified in Auto Mode + + * For add-ons that typically require IMDS access: + + * Supply parameters, such as AWS region, during installation to avoid IMDS lookups + + * For more information, see [Determine fields you can customize for Amazon EKS add-ons](./kubernetes-field-management.html) + + * If a pod absolutely requires IMDS access when running in Auto Mode: + + * The pod must be configured to run with `hostNetwork: true` + + * This allows the pod to access the instance metadata service directly + + * Consider the security implications when granting pods access to instance metadata + + + + +For more information about the EC2 Instance Metadata Service (IMDS), see [Configure the Instance Metadata Service options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html) in the EC2 User Guide. +