AWS eks medium security documentation change
Summary
Restructured prerequisites, added considerations for IAM role reuse and IRSA requirements, updated configuration steps for AWS Load Balancer Controller
Security assessment
Added explicit guidance about IAM role trust policies requiring cluster-specific OIDC provider configurations when using IRSA. This addresses potential misconfigurations that could lead to unauthorized access, making it security-related. The documentation now emphasizes proper IAM role scoping for service accounts.
Diff
diff --git a/eks/latest/userguide/lbc-manifest.md b/eks/latest/userguide/lbc-manifest.md index 05417e2f0..a0ba512f3 100644 --- a//eks/latest/userguide/lbc-manifest.md +++ b//eks/latest/userguide/lbc-manifest.md @@ -25 +25 @@ In the following steps, replace the `example values` with your own values. -Before starting this tutorial, you must install and configure the following tools and resources that you need to create and manage an Amazon EKS cluster. +Before starting this tutorial, you must complete the following steps: @@ -27 +27 @@ Before starting this tutorial, you must install and configure the following tool - * An existing Amazon EKS cluster. To deploy one, see [Get started with Amazon EKS](./getting-started.html). + * Create an Amazon EKS cluster. To create one, see [Get started with Amazon EKS](./getting-started.html). @@ -29 +29 @@ Before starting this tutorial, you must install and configure the following tool - * An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster. To determine whether you already have one, or to create one, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). + * Install [Helm](https://helm.sh/docs/helm/helm_install/) on your local machine. @@ -33 +33 @@ Before starting this tutorial, you must install and configure the following tool - * Familiarity with AWS Elastic Load Balancing. For more information, see the [Elastic Load Balancing User Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/). + * Learn about AWS Elastic Load Balancing concepts. For more information, see the [Elastic Load Balancing User Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/). @@ -35 +35 @@ Before starting this tutorial, you must install and configure the following tool - * Familiarity with Kubernetes [service](https://kubernetes.io/docs/concepts/services-networking/service/) and [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources. + * Learn about Kubernetes [service](https://kubernetes.io/docs/concepts/services-networking/service/) and [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources. @@ -40 +40,7 @@ Before starting this tutorial, you must install and configure the following tool -## Step 1: Configure IAM +### Considerations + +Before proceeding with the configuration steps on this page, consider the following: + + * The IAM policy and role (`AmazonEKSLoadBalancerControllerRole`) can be reused across multiple EKS clusters in the same AWS account. + + * If you’re installing the controller on the same cluster where the role (`AmazonEKSLoadBalancerControllerRole`) was originally created, go to Step 2: Install cert-manager after verifying the role exists. @@ -42 +48 @@ Before starting this tutorial, you must install and configure the following tool -###### Note + * If you’re using IAM Roles for Service Accounts (IRSA), IRSA must be set up for each cluster, and the OpenID Connect (OIDC) provider ARN in the role’s trust policy is specific to each EKS cluster. Additionally, if you’re installing the controller on a new cluster with an existing `AmazonEKSLoadBalancerControllerRole`, update the role’s trust policy to include the new cluster’s OIDC provider and create a new service account with the appropriate role annotation. To determine whether you already have an OIDC provider, or to create one, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). @@ -44 +49,0 @@ Before starting this tutorial, you must install and configure the following tool -You only need to create a role for the AWS Load Balancer Controller one per AWS account. Check if `AmazonEKSLoadBalancerControllerRole` exists in the [IAM Console](https://console.aws.amazon.com/iam). If this role exists, skip to Step 2: Install cert-manager. @@ -46 +50,0 @@ You only need to create a role for the AWS Load Balancer Controller one per AWS -###### Note @@ -48 +52,4 @@ You only need to create a role for the AWS Load Balancer Controller one per AWS -Below example is referring to the AWS Load Balancer Controller **v2.11.0** release version. For more inforamtion about all releases, see the [AWS Load Balancer Controller Release Page](https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/) on GitHub. + +## Step 1: Configure IAM + +The following steps refer to the AWS Load Balancer Controller **v2.11.0** release version. For more information about all releases, see the [AWS Load Balancer Controller Release Page](https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/) on GitHub.