AWS eks medium security documentation change
Summary
Added sections for cluster architecture, node, and pod requirements. Updated documentation for Pod Identity/IRSA credential acquisition in private clusters, added VPC endpoint requirements for EKS Auth API and SSM, and clarified service endpoint dependencies.
Security assessment
The changes explicitly document security-related configurations for private clusters, including requirements for VPC endpoints to handle credential acquisition (EKS Auth API and STS) without internet access. The addition of SSM endpoint documentation as an SSH alternative improves secure node management. These changes address secure communication patterns in restricted network environments.
Diff
diff --git a/eks/latest/userguide/private-clusters.md b/eks/latest/userguide/private-clusters.md index 891b6c2e3..2e6d86744 100644 --- a//eks/latest/userguide/private-clusters.md +++ b//eks/latest/userguide/private-clusters.md @@ -4,0 +5,2 @@ +Cluster architecture requirementsNode requirementsPod requirements + @@ -14,0 +17,2 @@ If you’re not familiar with Amazon EKS networking, see [De-mystifying cluster +## Cluster architecture requirements + @@ -18,0 +23,5 @@ If you’re not familiar with Amazon EKS networking, see [De-mystifying cluster + + + +## Node requirements + @@ -55 +64,8 @@ For additional arguments, see [Bootstrap script configuration parameters](./eks- - * Pods configured with [IAM roles for service accounts](./iam-roles-for-service-accounts.html) acquire credentials from an AWS Security Token Service (AWS STS) API call. If there is no outbound internet access, you must create and use an AWS STS VPC endpoint in your VPC. Most AWS `v1` SDKs use the global AWS STS endpoint by default (`sts.amazonaws.com`), which doesn’t use the AWS STS VPC endpoint. To use the AWS STS VPC endpoint, you might need to configure your SDK to use the regional AWS STS endpoint (`sts.`region-code`.amazonaws.com`). For more information, see [Configure the AWS Security Token Service endpoint for a service account](./configure-sts-endpoint.html). + + + +## Pod requirements + + * **Pod Identity** \- Pods configured with EKS Pod Identity acquire credentials from the EKS Auth API. If there is no outbound internet access, you must create and use a VPC endpoint for the EKS Auth API: `com.amazonaws.region-code.eks-auth`. For more information about the EKS and EKS Auth VPC endpoints, see [Access Amazon EKS using AWS PrivateLink](./vpc-interface-endpoints.html). + + * **IRSA** \- Pods configured with [IAM roles for service accounts](./iam-roles-for-service-accounts.html) acquire credentials from an AWS Security Token Service (AWS STS) API call. If there is no outbound internet access, you must create and use an AWS STS VPC endpoint in your VPC. Most AWS `v1` SDKs use the global AWS STS endpoint by default (`sts.amazonaws.com`), which doesn’t use the AWS STS VPC endpoint. To use the AWS STS VPC endpoint, you might need to configure your SDK to use the regional AWS STS endpoint (`sts.`region-code`.amazonaws.com`). For more information, see [Configure the AWS Security Token Service endpoint for a service account](./configure-sts-endpoint.html). @@ -65,3 +81,4 @@ Amazon Elastic Container Registry (for pulling container images) | com.amazonaw -Application Load Balancers and Network Load Balancers | com.amazonaws.`region-code`.elasticloadbalancing -AWS X-Ray | com.amazonaws.`region-code`.xray -Amazon CloudWatch Logs | com.amazonaws.`region-code`.logs +Amazon Application Load Balancers and Network Load Balancers | com.amazonaws.`region-code`.elasticloadbalancing +(Optional) AWS X-Ray (required for tracing sent to AWS X-Ray) | com.amazonaws.`region-code`.xray +(Optional) Amazon SSM (required for the SSM Agent for node management tasks. Alternative to SSH) | com.amazonaws.`region-code`.ssm +Amazon CloudWatch Logs (required for node and pod logs sent to Amazon CloudWatch Logs) | com.amazonaws.`region-code`.logs @@ -74 +91 @@ Amazon EKS | com.amazonaws.`region-code`.eks - * If your Pods use Amazon EFS volumes, then before deploying the [Store an elastic file system with Amazon EFS](./efs-csi.html), the driver’s [kustomization.yaml](https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/deploy/kubernetes/overlays/stable/kustomization.yaml) file must be changed to set the container images to use the same AWS Region as the Amazon EKS cluster. + * **EFS storage** \- If your Pods use Amazon EFS volumes, then before deploying the [Store an elastic file system with Amazon EFS](./efs-csi.html), the driver’s [kustomization.yaml](https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/deploy/kubernetes/overlays/stable/kustomization.yaml) file must be changed to set the container images to use the same AWS Region as the Amazon EKS cluster.