AWS eks medium security documentation change
Summary
Updated security group documentation to clarify inbound/outbound rules and EC2 security group limits. Changed terminology from 'ingress' to 'inbound' and added explanation about default outbound traffic behavior.
Security assessment
The changes explicitly document security group configuration requirements for hybrid nodes, including critical information about outbound traffic defaults and EC2 security group rule limits. This directly impacts network security posture by clarifying how to properly configure security groups to maintain cluster security. The 60-rule limit warning helps prevent misconfigurations that could leave resources exposed.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-networking.md b/eks/latest/userguide/hybrid-nodes-networking.md index 44dbe22ac..e50542bc9 100644 --- a//eks/latest/userguide/hybrid-nodes-networking.md +++ b//eks/latest/userguide/hybrid-nodes-networking.md @@ -46 +46 @@ If you are able to make your pod network routable on your on-premises network, f - 2. There are several techniques you can use to make your on-premises pod CIDR routable on your on-premises network including Border Gateway Protocol (BGP), static routes, or other custom routing solutions. BGP is the recommended solution as it is more scalable and easier to manage than alternative solutions that require custom or manual route configuration. AWS supports the BGP capabilities of Cilium and Calico for advertising pod CIDRs, see [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html) and [Routable remote Pod CIDRs](./hybrid-nodes-concepts-kubernetes.html#hybrid-nodes-concepts-k8s-pod-cidrs) for more information. + 2. There are several techniques you can use to make your on-premises pod CIDR routable on your on-premises network including Border Gateway Protocol (BGP), static routes, or other custom routing solutions. BGP is the recommended solution as it is more scalable and easier to manage than alternative solutions that require custom or manual route configuration. AWS supports the BGP capabilities of Cilium and Calico for advertising pod CIDRs, see [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html) and [Routable remote Pod CIDRs](./hybrid-nodes-concepts-kubernetes.html#hybrid-nodes-concepts-k8s-pod-cidrs) for more information. @@ -215 +215 @@ The examples below show how to create routes for your on-premises node and pod C - * Replace `REMOTE_POD_CIDR` with the CIDR range you will use for the pods running on hybrid nodes. The pod CIDR range corresponds to the Container Networking Interface (CNI) configuration, which most commonly uses an overlay network on-premises. For more information, see [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html). + * Replace `REMOTE_POD_CIDR` with the CIDR range you will use for the pods running on hybrid nodes. The pod CIDR range corresponds to the Container Networking Interface (CNI) configuration, which most commonly uses an overlay network on-premises. For more information, see [Configure CNI for hybrid nodes](./hybrid-nodes-cni.html). @@ -252 +252 @@ Run the following command for each of the subnets you created in the previous st -The following access for your EKS cluster security group is required for ongoing cluster operations. Amazon EKS automatically creates the required **ingress** security group rules for hybrid nodes when you create or update your cluster with remote node and pod networks configured. +The following access for your EKS cluster security group is required for ongoing cluster operations. Amazon EKS automatically creates the required **inbound** security group rules for hybrid nodes when you create or update your cluster with remote node and pod networks configured. Because security groups allow all **outbound** traffic by default, Amazon EKS doesn’t automatically modify the **outbound** rules of the cluster security group for hybrid nodes. If you want to customize the cluster security group, you can limit traffic to the rules in the following table. @@ -263 +263 @@ HTTPS | TCP | Outbound | Webhook ports | N/A | Remote Pod CIDR(s) | Kubern -**Security group rule limits** : Amazon EC2 security groups have a maximum of 60 ingress rules by default. The security group ingress rules may not apply if your cluster security group approaches this limit. In this case, it may be required to manually add in the missing ingress rules. +**Security group rule limits** : Amazon EC2 security groups have a maximum of 60 inbound rules by default. The security group inbound rules may not apply if your cluster security group approaches this limit. In this case, it may be required to manually add in the missing inbound rules.