AWS eks documentation change
Summary
Restructured documentation with expanded security considerations, DNS configuration details, and connectivity options for Amazon EKS interface endpoints
Security assessment
The changes emphasize security controls like VPC endpoint policies, security group associations, and VPC flow logs for monitoring traffic. While these are security best practices, there is no evidence of addressing a specific vulnerability. The updates primarily enhance documentation of existing security features rather than patching a security issue.
Diff
diff --git a/eks/latest/userguide/vpc-interface-endpoints.md b/eks/latest/userguide/vpc-interface-endpoints.md index 69f42d484..3853ad2e8 100644 --- a//eks/latest/userguide/vpc-interface-endpoints.md +++ b//eks/latest/userguide/vpc-interface-endpoints.md @@ -5 +5 @@ -Considerations for Amazon EKSCreate an interface endpoint for Amazon EKS +Before you beginConsiderationsCreate an interface endpoint for Amazon EKSPrivate DNS feature for Amazon EKS interface endpoints @@ -19 +19 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// -## Considerations for Amazon EKS +## Before you begin @@ -21 +21 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Before you set up an interface endpoint for Amazon EKS, review [Considerations](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#considerations-interface-endpoints) in the _AWS PrivateLink Guide_. +Before you start, make sure you have performed the following tasks: @@ -23 +23 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Amazon EKS supports making calls to all of its API actions through the interface endpoint, but not to the Kubernetes APIs. The Kubernetes API server already supports a [private endpoint](./cluster-endpoint.html). The Kubernetes API server private endpoint creates a private endpoint for the Kubernetes API server that you use to communicate with your cluster (using Kubernetes management tools such as `kubectl`). You can enable [private access](./private-clusters.html) to the Kubernetes API server so that all communication between your nodes and the API server stays within your VPC. AWS PrivateLink for the Amazon EKS API helps you call the Amazon EKS APIs from your VPC without exposing traffic to the public internet. + * Review [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#considerations-interface-endpoints) in the _AWS PrivateLink Guide_ @@ -25 +24,0 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * You can’t configure Amazon EKS to only be accessed through an interface endpoint. @@ -27 +25,0 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Standard pricing for AWS PrivateLink applies for interface endpoints for Amazon EKS. You are billed for every hour that an interface endpoint is provisioned in each Availability Zone and for data processed through the interface endpoint. For more information, see [AWS PrivateLink pricing](https://aws.amazon.com/privatelink/pricing/). @@ -29 +26,0 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * VPC endpoint policies are supported for Amazon EKS. You can use these policies to control access to Amazon EKS through the interface endpoint. Additionally, you can associate a security group with the endpoint network interfaces to control traffic to Amazon EKS through the interface endpoint. For more information, see [Control access to VPC endpoints using endpoint policies](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) in the Amazon VPC docs. @@ -31 +28 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * You can use VPC flow logs to capture information about IP traffic going to and from network interfaces, including interface endpoints. You can publish flow log data to Amazon CloudWatch or Amazon S3. For more information, see [Logging IP traffic using VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) in the Amazon VPC User Guide. +## Considerations @@ -33 +30 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * You can access the Amazon EKS APIs from an on-premises data center by connecting it to a VPC that has an interface endpoint. You can use AWS Direct Connect or AWS Site-to-Site VPN to connect your on-premises sites to a VPC. + * **Support and Limitations** : Amazon EKS interface endpoints enable secure access to all Amazon EKS API actions from your VPC but come with specific limitations: they do not support access to Kubernetes APIs, as these have a separate private endpoint, you cannot configure Amazon EKS to be accessible only through the interface endpoint. @@ -35 +32 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * You can connect other VPCs to the VPC with an interface endpoint using an AWS Transit Gateway or VPC peering. VPC peering is a networking connection between two VPCs. You can establish a VPC peering connection between your VPCs, or with a VPC in another account. The VPCs can be in different AWS Regions. Traffic between peered VPCs stays on the AWS network. The traffic doesn’t traverse the public internet. A Transit Gateway is a network transit hub that you can use to interconnect VPCs. Traffic between a VPC and a Transit Gateway remains on the AWS global private network. The traffic isn’t exposed to the public internet. + * **Pricing** : Using interface endpoints for Amazon EKS incurs standard AWS PrivateLink charges: hourly charges for each endpoint provisioned in each Availability Zone, data processing charges for traffic through the endpoint. To learn more, see [AWS PrivateLink pricing](https://aws.amazon.com/privatelink/pricing/). @@ -37 +34 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * Before August 2024, VPC interface endpoints for Amazon EKS were only accessible over `IPv4` using `eks.`region`.amazonaws.com`. New VPC interface endpoints that are made after August 2024 use dual-stack of `IPv4` and `IPv6` IP addresses and both DNS names: `eks.`region`.amazonaws.com` and `eks.`region`.api.aws`. + * **Security and Access Control** : We recommend enhancing security and controlling access with these additional configurations—use VPC endpoint policies to control access to Amazon EKS through the interface endpoint, associate security groups with endpoint network interfaces to manage traffic, use VPC flow logs to capture and monitor IP traffic to and from the interface endpoints, with logs publishable to Amazon CloudWatch or Amazon S3. To learn more, see [Control access to VPC endpoints using endpoint policies](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) and [Logging IP traffic using VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). @@ -39 +36,5 @@ For more information, see [Access AWS services through AWS PrivateLink](https:// - * AWS PrivateLink support for the EKS API isn’t available in the Asia Pacific (Malaysia) (`ap-southeast-5`), Asia Pacific (Thailand) (`ap-southeast-7`), Mexico (Central) (`mx-central-1`), and Asia Pacific (Taipei) (`ap-east-2`) AWS Regions. AWS PrivateLink support for `eks-auth` for EKS Pod Identity is available in the the Asia Pacific (Malaysia) (`ap-southeast-5`) Region. + * **Connectivity Options** : Interface endpoints offer flexible connectivity options using **on-premises access** (connect your on-premises data center to a VPC with the interface endpoint using AWS Direct Connect or AWS Site-to-Site VPN) or via **inter-VPC connectivity** (use AWS Transit Gateway or VPC peering to connect other VPCs to the VPC with the interface endpoint, keeping traffic within the AWS network). + + * **IP Version Support** : Endpoints created before August 2024 support only IPv4 using eks.region.amazonaws.com. New endpoints created after August 2024 support dual-stack IPv4 and IPv6 (e.g., eks.region.amazonaws.com, eks.region.api.aws). + + * **Regional Availability** : AWS PrivateLink for the EKS API is not available in Asia Pacific (Malaysia) (ap-southeast-5), Asia Pacific (Thailand) (ap-southeast-7), Mexico (Central) (mx-central-1), and Asia Pacific (Taipei) (ap-east-2) regions. AWS PrivateLink support for eks-auth (EKS Pod Identity) is available in the Asia Pacific (Malaysia) (ap-southeast-5) region. @@ -50 +51,27 @@ Create an interface endpoint for Amazon EKS using the following service names: - * EKS API +### EKS API + + * com.amazonaws.region-code.eks + + * com.amazonaws.region-code.eks-fips (for FIPS-compliant endpoints) + + + + +### EKS Auth API (EKS Pod Identity) + + * com.amazonaws.region-code.eks-auth + + + + +## Private DNS feature for Amazon EKS interface endpoints + +The private DNS feature, enabled by default for interface endpoints of Amazon EKS and other AWS services, facilitates secure and private API requests using default Regional DNS names. This feature ensures that API calls are routed through the interface endpoint over the private AWS network, enhancing security and performance. + +The private DNS feature activates automatically when you create an interface endpoint for Amazon EKS or other AWS services. To enable, you need to configure your VPC correctly by setting specific attributes: + + * **enableDnsHostnames** : Allows instances within the VPC to have DNS hostnames. + + * **enableDnsSupport** : Enables DNS resolution throughout the VPC. + + @@ -52,0 +80 @@ Create an interface endpoint for Amazon EKS using the following service names: +For step-by-step instructions to check or modify these settings, see [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updating). @@ -53,0 +82 @@ Create an interface endpoint for Amazon EKS using the following service names: +### DNS names and IP address types @@ -54,0 +84 @@ Create an interface endpoint for Amazon EKS using the following service names: +With the private DNS feature enabled, you can use specific DNS names to connect to Amazon EKS, and these options evolve over time: @@ -56 +86 @@ Create an interface endpoint for Amazon EKS using the following service names: - com.amazonaws.region-code.eks + * **eks.region.amazonaws.com** : The traditional DNS name, resolving only to IPv4 addresses before August 2024. For existing endpoints updated to dual-stack, this name resolves to both IPv4 and IPv6 addresses. @@ -58 +88 @@ Create an interface endpoint for Amazon EKS using the following service names: - * EKS Auth API (EKS Pod Identity) + * **eks.region.api.aws** : Available for new endpoints created after August 2024, this dual-stack DNS name resolves to both IPv4 and IPv6 addresses. @@ -62,0 +93 @@ Create an interface endpoint for Amazon EKS using the following service names: +After August 2024, new interface endpoints come with two DNS names, and you can opt for the dual-stack IP address type. For existing endpoints, updating to dual-stack modifies **eks.region.amazonaws.com** to support both IPv4 and IPv6. @@ -64 +95 @@ Create an interface endpoint for Amazon EKS using the following service names: - com.amazonaws.region-code.eks-auth +### Using the Private DNS feature @@ -66 +97 @@ Create an interface endpoint for Amazon EKS using the following service names: -The private DNS feature is enabled by default when creating an interface endpoint for Amazon EKS and other AWS services. To use the private DNS feature, you must ensure that the following VPC attributes are set to `true`: `enableDnsHostnames` and `enableDnsSupport`. For more information, see [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updating) in the Amazon VPC User Guide. With the private DNS feature enabled for the interface endpoint: +Once configured, the private DNS feature can be integrated into your workflows, offering the following capabilities: @@ -68 +99 @@ The private DNS feature is enabled by default when creating an interface endpoin - * You can make any API request to Amazon EKS using its default Regional DNS name. After August 2024, any new VPC interface endpoint for the Amazon EKS API have two default Regional DNS names and you can choose the `dualstack` for the IP address type. The first DNS name is `eks.`region`.api.aws` which is dual-stack. It resolves to both `IPv4` addresses and `IPv6` addresses. Before August 2024, Amazon EKS only used `eks.`region`.amazonaws.com` which resolved to `IPv4` addresses only. If you want to use `IPv6` and dual-stack IP addresses with an existing VPC interface endpoint, you can update the endpoint to use the `dualstack` type of IP address, but it will only have the `eks.`region`.amazonaws.com` DNS name. In this configuration, the existing endpoint updates to point that name to both `IPv4` and `IPv6` IP addresses. For a list of APIs, see [Actions](https://docs.aws.amazon.com/eks/latest/APIReference/API_Operations.html) in the Amazon EKS API Reference. + * **API Requests** : Use the default Regional DNS names, either `eks.region.amazonaws.com` or `eks.region.api.aws`, based on your endpoint’s setup to make API requests to Amazon EKS. @@ -70 +101 @@ The private DNS feature is enabled by default when creating an interface endpoin - * You don’t need to make any changes to your applications that call the EKS APIs. + * **Application Compatibility** : Your existing applications that call EKS APIs require no changes to leverage this feature. @@ -72 +103 @@ The private DNS feature is enabled by default when creating an interface endpoin -However, To use the dual-stack endpoints with the AWS CLI, see the [Dual-stack and FIPS endpoints](https://docs.aws.amazon.com/sdkref/latest/guide/feature-endpoints.html) configuration in the _AWS SDKs and Tools Reference Guide_. + * **AWS CLI with Dual-Stack** : To use the dual-stack endpoints with the AWS CLI, see the [Dual-stack and FIPS endpoints](https://docs.aws.amazon.com/sdkref/latest/guide/feature-endpoints.html) configuration in the _AWS SDKs and Tools Reference Guide_. @@ -74 +105 @@ However, To use the dual-stack endpoints with the AWS CLI, see the [Dual-stack a - * Any call made to the Amazon EKS default service endpoint is automatically routed through the interface endpoint over the private AWS network. + * **Automatic Routing** : Any call to the Amazon EKS default service endpoint is automatically directed through the interface endpoint, ensuring private and secure connectivity.