AWS eks medium security documentation change
Summary
Updated documentation for EKS Auto Mode security configurations including IMDSv2 enforcement, Pod network requirements, and storage considerations
Security assessment
The changes explicitly document security configurations like enforcing IMDSv2 with hop limit 1, requirements for Pods needing IMDS access, and warnings about security implications. These updates clarify security best practices but don't indicate a specific vulnerability being patched.
Diff
diff --git a/eks/latest/userguide/automode-learn-instances.md b/eks/latest/userguide/automode-learn-instances.md index a161e538e..ad4de2ac9 100644 --- a//eks/latest/userguide/automode-learn-instances.md +++ b//eks/latest/userguide/automode-learn-instances.md @@ -1 +1 @@ -[](/pdfs/eks/latest/userguide/eks-ug.pdf#automode-learn-instances "Open PDF")[](https://github.com/awsdocs/amazon-eks-user-guide/tree/mainline/latest/ug/automode-learn-instances.xml "Edit this page on GitHub") +[](/pdfs/eks/latest/userguide/eks-ug.pdf#automode-learn-instances "Open PDF")[](https://github.com/awsdocs/amazon-eks-user-guide/tree/mainline/latest/ug/automode/automode-learn-instances.adoc "Edit this page on GitHub") @@ -84 +84 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * EKS Auto Mode enforces IMDSv2 with a hop limit of 1 by default, adhering to AWS security best practices + * EKS Auto Mode enforces IMDSv2 with a hop limit of 1 by default, adhering to AWS security best practices. @@ -86 +86 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * This default configuration cannot be modified in Auto Mode + * This default configuration cannot be modified in Auto Mode. @@ -88 +88 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * For add-ons that typically require IMDS access: + * For add-ons that typically require IMDS access, supply parameters (such as AWS region) during installation to avoid IMDS lookups. For more information, see [Determine fields you can customize for Amazon EKS add-ons](./kubernetes-field-management.html). @@ -90 +90 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * Supply parameters, such as AWS region, during installation to avoid IMDS lookups + * If a Pod absolutely requires IMDS access when running in Auto Mode, the Pod must be configured to run with `hostNetwork: true`. This allows the Pod to access the instance metadata service directly. @@ -92 +92 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * For more information, see [Determine fields you can customize for Amazon EKS add-ons](./kubernetes-field-management.html) + * Consider the security implications when granting Pods access to instance metadata. @@ -94 +93,0 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * If a pod absolutely requires IMDS access when running in Auto Mode: @@ -96,5 +94,0 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// - * The pod must be configured to run with `hostNetwork: true` - - * This allows the pod to access the instance metadata service directly - - * Consider the security implications when granting pods access to instance metadata @@ -102,0 +97 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// +For more information about the Amazon EC2 Instance Metadata Service (IMDS), see [Configure the Instance Metadata Service options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html) in the _Amazon EC2 User Guide_. @@ -103,0 +99 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// +## Considerations @@ -105 +101 @@ For more information, see [Amazon EC2 instance type naming conventions](https:// -For more information about the EC2 Instance Metadata Service (IMDS), see [Configure the Instance Metadata Service options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html) in the EC2 User Guide. + * If the configured ephemeral storage in the NodeClass is smaller than the NVMe local storage for the instance, EKS Auto Mode eliminates the need for manual configuration by automatically taking the following actions: @@ -107 +103 @@ For more information about the EC2 Instance Metadata Service (IMDS), see [Config -## Considerations + * Uses a smaller (20 GiB) Amazon EBS data volume to reduce costs. @@ -109 +105 @@ For more information about the EC2 Instance Metadata Service (IMDS), see [Config - * EKS Auto Mode automatically formats and configures NVMe local storage on supported instance types. For nodes with multiple NVMe drives, EKS sets up a RAID 0 array. This automation eliminates the need for manual formatting and RAID configuration of local NVMe storage in EKS clusters. + * Formats and configures the NVMe local storage for ephemeral data use. This includes setting up a RAID 0 array if there are multiple NVMe drives. @@ -115 +111 @@ For more information about the EC2 Instance Metadata Service (IMDS), see [Config - * If you have other types of nodes in your cluster, you need to configure the Neuron Device plugin to not run on auto mode nodes. For more information, see [Control if a workload is deployed on EKS Auto Mode nodes](./associate-workload.html). +If you have other types of nodes in your cluster, you need to configure the Neuron Device plugin to not run on Auto Mode nodes. For more information, see [Control if a workload is deployed on EKS Auto Mode nodes](./associate-workload.html).