AWS eks medium security documentation change
Summary
Clarified access entry precedence over ConfigMap entries and migration warnings
Security assessment
Explicitly documents that access entries take precedence over legacy ConfigMap entries, which is critical for understanding authentication chain and preventing accidental privilege escalation during migration.
Diff
diff --git a/eks/latest/userguide/migrating-access-entries.md b/eks/latest/userguide/migrating-access-entries.md index b9e6c3a95..eba7dbb48 100644 --- a//eks/latest/userguide/migrating-access-entries.md +++ b//eks/latest/userguide/migrating-access-entries.md @@ -17 +17,6 @@ If you’ve added entries to the `aws-auth` `ConfigMap` on your cluster, we reco -Before removing existing `aws-auth` `ConfigMap` entries that were created by Amazon EKS for [managed node group](./managed-node-groups.html) or a [Fargate profile](./fargate-profile.html) to your cluster, double check if the correct access entries for those specific resources exist in your Amazon EKS cluster. If you remove entries that Amazon EKS created in the `ConfigMap` without having the equivalent access entries, your cluster won’t function properly. + * When a cluster is in `API_AND_CONFIGMAP` authentication mode and there’s a mapping for the same IAM role in both the `aws-auth` `ConfigMap` and in access entries, the role will use the access entry’s mapping for authentication. Access entries take precedence over `ConfigMap` entries for the same IAM principal. + + * Before removing existing `aws-auth` `ConfigMap` entries that were created by Amazon EKS for [managed node group](./managed-node-groups.html) or a [Fargate profile](./fargate-profile.html) to your cluster, double check if the correct access entries for those specific resources exist in your Amazon EKS cluster. If you remove entries that Amazon EKS created in the `ConfigMap` without having the equivalent access entries, your cluster won’t function properly. + + +