AWS eks documentation change
Summary
Simplified explanation of eksctl command for associating IAM roles with service accounts
Security assessment
Clarifies security best practices for IAM role association with Kubernetes service accounts, but does not address a specific security issue.
Diff
diff --git a/eks/latest/userguide/associate-service-account-role.md b/eks/latest/userguide/associate-service-account-role.md index 07ef648ca..dc1f620a8 100644 --- a//eks/latest/userguide/associate-service-account-role.md +++ b//eks/latest/userguide/associate-service-account-role.md @@ -66,3 +66 @@ Create an IAM role and associate it with a Kubernetes service account. You can u -Version `0.210.0` or later of the `eksctl` command line tool installed on your device or AWS CloudShell. To install or update `eksctl`, see [Installation](https://eksctl.io/installation) in the `eksctl` documentation. - -Replace `my-service-account` with the name of the Kubernetes service account that you want `eksctl` to create and associate with an IAM role. Replace `default` with the namespace that you want `eksctl` to create the service account in. Replace `my-cluster` with the name of your cluster. Replace `my-role` with the name of the role that you want to associate the service account to. If it doesn’t already exist, `eksctl` creates it for you. Replace `111122223333` with your account ID and `my-policy` with the name of an existing policy. +This `eksctl` command creates a Kubernetes service account in the specified namespace, creates an IAM role (if it doesn’t exist) with the specified name, attaches an existing IAM policy ARN to the role, and annotates the service account with the IAM role ARN. Be sure to replace the sample placeholder values in this command with your specific values. To install or update `eksctl`, see [Installation](https://eksctl.io/installation) in the `eksctl` documentation.