AWS eks documentation change
Summary
Added new AWS managed policy AmazonEKSDashboardConsoleReadOnly, updated AmazonEKSComputePolicy to include EC2 Spot service-linked role creation permissions, expanded EC2 permissions in AmazonEKSServiceRolePolicy, and added change log entries
Security assessment
The addition of AmazonEKSDashboardConsoleReadOnly introduces a security-focused policy enforcing read-only access to EKS dashboard data and AWS Organizations information, which improves security posture through least privilege. The EC2 Spot service-linked role and capacity reservation permissions appear to be feature enhancements rather than vulnerability fixes. No evidence of addressing an active security vulnerability is present in the changes.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index b89ebe1d2..c303295c6 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies +AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSDashboardConsoleReadOnlyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies @@ -60,0 +61,21 @@ To view the latest version of the JSON policy document, see [AmazonEKSClusterPol +## AWS managed policy: AmazonEKSDashboardConsoleReadOnly + +You can attach `AmazonEKSDashboardConsoleReadOnly` to your IAM entities. + +This policy includes the following permissions that allow Amazon EKS to complete the following tasks: + + * **`eks` ** \- Read-only access to EKS dashboard data, resources, and cluster versions information. This allows viewing EKS-related metrics and cluster configuration details. + + * **`organizations` ** \- Read-only access to AWS Organizations information, including: + + * Viewing organization details and service access + + * Listing organizational roots, accounts, and organizational units + + * Viewing organization structure + + + + +To view the latest version of the JSON policy document, see [AmazonEKSDashboardConsoleReadOnly](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEKSDashboardConsoleReadOnly.html#AmazonEKSDashboardConsoleReadOnly-json) in the AWS Managed Policy Reference Guide. + @@ -99 +120 @@ You can attach `AmazonEKSComputePolicy` to your IAM entities. You may attach thi -This policy grants the permissions required for Amazon EKS to create and manage EC2 instances for the EKS cluster, as well as the necessary IAM permissions to configure EC2. +This policy grants the permissions required for Amazon EKS to create and manage EC2 instances for the EKS cluster, and the necessary IAM permissions to configure EC2. Also, this policy grants the permissions for Amazon EKS to create the EC2 Spot service-linked role on your behalf. @@ -254 +275 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`ec2` ** – Create and describe Elastic Network Interfaces and Amazon EC2 instances, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. + * **`ec2` ** – Create and describe Elastic Network Interfaces and Amazon EC2 instances, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. Read information about On-Demand Capacity Reservations. @@ -440,0 +462,3 @@ Change | Description | Date +Added permission to AWS managed policy: AmazonEKSComputePolicy. | Updated resource permissions for the `ec2:RunInstances` and `ec2:CreateFleet` actions to include capacity reservations `arn:aws:ec2:*:*:capacity-reservation/*`. This allows Amazon EKS Auto Mode to launch instances by using the EC2 On-Demand Capacity Reservations in your account. Added `iam:CreateServiceLinkedRole` to allow Amazon EKS Auto Mode to create the EC2 Spot service-linked role `AWSServiceRoleForEC2Spot` on your behalf. | June 20, 2025 +Added permission to AmazonEKSServiceRolePolicy. | Added `ec2:DescribeCapacityReservations` permission to allow Amazon EKS Auto Mode to launch instances by using the EC2 On-Demand Capacity Reservations in your account. | June 20, 2025 +Introduced AWS managed policy: AmazonEKSDashboardConsoleReadOnly. | Introduced new `AmazonEKSDashboardConsoleReadOnly` policy. | June 19, 2025