AWS code-library medium security documentation change
Summary
Added documentation for 'associate-access-policy' CLI command with example usage and output
Security assessment
The change documents access policy association which controls Kubernetes cluster access permissions. Improper configuration could lead to privilege escalation vulnerabilities.
Diff
diff --git a/code-library/latest/ug/cli_2_eks_code_examples.md b/code-library/latest/ug/cli_2_eks_code_examples.md index 64b347287..f31793b51 100644 --- a//code-library/latest/ug/cli_2_eks_code_examples.md +++ b//code-library/latest/ug/cli_2_eks_code_examples.md @@ -25,0 +26,43 @@ Each example includes a link to the complete source code, where you can find ins +The following code example shows how to use `associate-access-policy`. + +**AWS CLI** + + +**To associate an access policy and its scope to the access entry of the cluster** + +The following `associate-access-policy` associates an access policy and its scope to the access entry of the specified cluster. + + + aws eks associate-access-policy \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:role/Admin \ + --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy \ + --access-scope type=namespace,namespaces=default + + +Output: + + + { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:role/Admin", + "associatedAccessPolicy": { + "policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy", + "accessScope": { + "type": "namespace", + "namespaces": [ + "default" + ] + }, + "associatedAt": "2025-05-24T15:59:51.981000-05:00", + "modifiedAt": "2025-05-24T15:59:51.981000-05:00" + } + } + +For more information, see [Associate access policies with access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html) in the _Amazon EKS User Guide_. + + * For API details, see [AssociateAccessPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/associate-access-policy.html) in _AWS CLI Command Reference_. + + + + @@ -111,0 +155,71 @@ For more information, see [Authenticate users for your cluster from an OpenID Co +The following code example shows how to use `create-access-entry`. + +**AWS CLI** + + +**Example 1: To create the access entry for EKS cluster** + +The following `create-access-entry` example creates an access entry that allows an IAM principal to access the EKS cluster. + + + aws eks create-access-entry \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:user/eks-user + + +Output: + + + { + "accessEntry": { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:user/eks-user", + "kubernetesGroups": [], + "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-user/a1b2c3d4-5678-90ab-cdef-a6506e3d36p0", + "createdAt": "2025-04-14T22:45:48.097000-05:00", + "modifiedAt": "2025-04-14T22:45:48.097000-05:00", + "tags": {}, + "username": "arn:aws:iam::111122223333:user/eks-user", + "type": "STANDARD" + } + } + +For more information, see [Create access entries](https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html) in the _Amazon EKS User Guide_. + +**Example 2: To create the access entry for EKS cluster by specifying the type of access entry** + +The following `create-access-entry` example creates an access entry of type `EC2_LINUX` in the EKS cluster. By default, a type `STANDARD` access entry is created. Apart from the default, if we specify any other access entry types, an IAM role ARN needs to be passed in the CLI. + + + aws eks create-access-entry \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:role/admin-test-ip \ + --type EC2_LINUX + + +Output: + + + { + "accessEntry": { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:role/admin-test-ip", + "kubernetesGroups": [ + "system:nodes" + ], + "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/role/111122223333/admin-test-ip/accb5418-f493-f390-3e6e-c3f19f725fcp", + "createdAt": "2025-05-06T19:42:45.453000-05:00", + "modifiedAt": "2025-05-06T19:42:45.453000-05:00", + "tags": {}, + "username": "system:node:{{EC2PrivateDNSName}}", + "type": "EC2_LINUX" + } + } + +For more information, see [Create access entries](https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html) in the _Amazon EKS User Guide_. + + * For API details, see [CreateAccessEntry](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/create-access-entry.html) in _AWS CLI Command Reference_. + + + + @@ -878,0 +993,100 @@ For more information, see [Creating a managed node group](https://docs.aws.amazo +The following code example shows how to use `create-pod-identity-association`. + +**AWS CLI** + + +**Example 1: To create an EKS Pod Identity association in EKS cluster** + +The following `create-pod-identity-association` example creates an EKS Pod Identity association between a service account in the EKS cluster and an IAM role. + + + aws eks create-pod-identity-association \ + --cluster-name eks-customer \ + --namespace default \ + --service-account default \ + --role-arn arn:aws:iam::111122223333:role/my-role + + +Output: + + + { + "association": { + "clusterName": "eks-customer", + "namespace": "default", + "serviceAccount": "default", + "roleArn": "arn:aws:iam::111122223333:role/my-role", + "associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-8mvwvh57cu74mgcst", + "associationId": "a-8mvwvh57cu74mgcst", + "tags": {}, + "createdAt": "2025-05-24T19:40:13.961000-05:00", + "modifiedAt": "2025-05-24T19:40:13.961000-05:00" + } + } + +For more information, see [Learn how EKS Pod Identity grants pods access to AWS services](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) in the _Amazon EKS User Guide_. + +**Example 2: To create an EKS Pod Identity association in EKS cluster with tags** + +The following `create-pod-identity-association` creates an EKS Pod Identity association between a service account and an IAM role in the EKS cluster with tags. + + + aws eks create-pod-identity-association \ + --cluster-name eks-customer \ + --namespace default \ + --service-account default \ + --role-arn arn:aws:iam::111122223333:role/my-role \ + --tags Key1=value1,Key2=value2 + + +Output: + + + { + "association": { + "clusterName": "eks-customer", + "namespace": "default", + "serviceAccount": "default", + "roleArn": "arn:aws:iam::111122223333:role/my-role", + "associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-9njjin9gfghecgoda", + "associationId": "a-9njjin9gfghecgoda", + "tags": { + "Key2": "value2", + "Key1": "value1" + }, + "createdAt": "2025-05-24T19:52:14.135000-05:00", + "modifiedAt": "2025-05-24T19:52:14.135000-05:00" + } + } + +For more information, see [Learn how EKS Pod Identity grants pods access to AWS services](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) in the _Amazon EKS User Guide_. + + * For API details, see [CreatePodIdentityAssociation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/create-pod-identity-association.html) in _AWS CLI Command Reference_. + + + + +The following code example shows how to use `delete-access-entry`. + +**AWS CLI**