AWS code-library medium security documentation change
Summary
Added documentation for 'list-pod-identity-associations' CLI command
Security assessment
Listing pod identity associations helps audit service account permissions across namespaces.
Diff
diff --git a/code-library/latest/ug/cli_2_eks_code_examples.md b/code-library/latest/ug/cli_2_eks_code_examples.md index 64b347287..f31793b51 100644 --- a//code-library/latest/ug/cli_2_eks_code_examples.md +++ b//code-library/latest/ug/cli_2_eks_code_examples.md @@ -25,0 +26,43 @@ Each example includes a link to the complete source code, where you can find ins +The following code example shows how to use `associate-access-policy`. + +**AWS CLI** + + +**To associate an access policy and its scope to the access entry of the cluster** + +The following `associate-access-policy` associates an access policy and its scope to the access entry of the specified cluster. + + + aws eks associate-access-policy \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:role/Admin \ + --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy \ + --access-scope type=namespace,namespaces=default + + +Output: + + + { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:role/Admin", + "associatedAccessPolicy": { + "policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy", + "accessScope": { + "type": "namespace", + "namespaces": [ + "default" + ] + }, + "associatedAt": "2025-05-24T15:59:51.981000-05:00", + "modifiedAt": "2025-05-24T15:59:51.981000-05:00" + } + } + +For more information, see [Associate access policies with access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html) in the _Amazon EKS User Guide_. + + * For API details, see [AssociateAccessPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/associate-access-policy.html) in _AWS CLI Command Reference_. + + + + @@ -111,0 +155,71 @@ For more information, see [Authenticate users for your cluster from an OpenID Co +The following code example shows how to use `create-access-entry`. + +**AWS CLI** + + +**Example 1: To create the access entry for EKS cluster** + +The following `create-access-entry` example creates an access entry that allows an IAM principal to access the EKS cluster. + + + aws eks create-access-entry \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:user/eks-user + + +Output: + + + { + "accessEntry": { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:user/eks-user", + "kubernetesGroups": [], + "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-user/a1b2c3d4-5678-90ab-cdef-a6506e3d36p0", + "createdAt": "2025-04-14T22:45:48.097000-05:00", + "modifiedAt": "2025-04-14T22:45:48.097000-05:00", + "tags": {}, + "username": "arn:aws:iam::111122223333:user/eks-user", + "type": "STANDARD" + } + } + +For more information, see [Create access entries](https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html) in the _Amazon EKS User Guide_. + +**Example 2: To create the access entry for EKS cluster by specifying the type of access entry** + +The following `create-access-entry` example creates an access entry of type `EC2_LINUX` in the EKS cluster. By default, a type `STANDARD` access entry is created. Apart from the default, if we specify any other access entry types, an IAM role ARN needs to be passed in the CLI. + + + aws eks create-access-entry \ + --cluster-name eks-customer \ + --principal-arn arn:aws:iam::111122223333:role/admin-test-ip \ + --type EC2_LINUX + + +Output: + + + { + "accessEntry": { + "clusterName": "eks-customer", + "principalArn": "arn:aws:iam::111122223333:role/admin-test-ip", + "kubernetesGroups": [ + "system:nodes" + ], + "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/role/111122223333/admin-test-ip/accb5418-f493-f390-3e6e-c3f19f725fcp", + "createdAt": "2025-05-06T19:42:45.453000-05:00", + "modifiedAt": "2025-05-06T19:42:45.453000-05:00", + "tags": {}, + "username": "system:node:{{EC2PrivateDNSName}}", + "type": "EC2_LINUX" + } + } + +For more information, see [Create access entries](https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html) in the _Amazon EKS User Guide_. + + * For API details, see [CreateAccessEntry](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/create-access-entry.html) in _AWS CLI Command Reference_. + + + + @@ -878,0 +993,100 @@ For more information, see [Creating a managed node group](https://docs.aws.amazo +The following code example shows how to use `create-pod-identity-association`. + +**AWS CLI** + + +**Example 1: To create an EKS Pod Identity association in EKS cluster** + +The following `create-pod-identity-association` example creates an EKS Pod Identity association between a service account in the EKS cluster and an IAM role. + + + aws eks create-pod-identity-association \ + --cluster-name eks-customer \ + --namespace default \ + --service-account default \ + --role-arn arn:aws:iam::111122223333:role/my-role + + +Output: + + + { + "association": { + "clusterName": "eks-customer", + "namespace": "default", + "serviceAccount": "default", + "roleArn": "arn:aws:iam::111122223333:role/my-role", + "associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-8mvwvh57cu74mgcst", + "associationId": "a-8mvwvh57cu74mgcst", + "tags": {}, + "createdAt": "2025-05-24T19:40:13.961000-05:00", + "modifiedAt": "2025-05-24T19:40:13.961000-05:00" + } + } + +For more information, see [Learn how EKS Pod Identity grants pods access to AWS services](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) in the _Amazon EKS User Guide_. + +**Example 2: To create an EKS Pod Identity association in EKS cluster with tags** + +The following `create-pod-identity-association` creates an EKS Pod Identity association between a service account and an IAM role in the EKS cluster with tags. + + + aws eks create-pod-identity-association \ + --cluster-name eks-customer \ + --namespace default \ + --service-account default \ + --role-arn arn:aws:iam::111122223333:role/my-role \ + --tags Key1=value1,Key2=value2 + + +Output: + + + { + "association": { + "clusterName": "eks-customer", + "namespace": "default", + "serviceAccount": "default", + "roleArn": "arn:aws:iam::111122223333:role/my-role", + "associationArn": "arn:aws:eks:us-west-2:111122223333:podidentityassociation/eks-customer/a-9njjin9gfghecgoda", + "associationId": "a-9njjin9gfghecgoda", + "tags": { + "Key2": "value2", + "Key1": "value1" + }, + "createdAt": "2025-05-24T19:52:14.135000-05:00", + "modifiedAt": "2025-05-24T19:52:14.135000-05:00" + } + } + +For more information, see [Learn how EKS Pod Identity grants pods access to AWS services](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) in the _Amazon EKS User Guide_. + + * For API details, see [CreatePodIdentityAssociation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/create-pod-identity-association.html) in _AWS CLI Command Reference_. + + + + +The following code example shows how to use `delete-access-entry`. + +**AWS CLI**