AWS eks high security documentation change

Service: eks · 2025-10-13 · Security-related high

File: eks/latest/eksctl/minimum-iam-policies.md

Summary

Removed detailed IAM policy JSON content and replaced with error messages about missing UUIDs

Security assessment

The removal of explicit IAM policy configurations could lead to misconfigurations in minimum required permissions for eksctl operations. Missing proper IAM policy documentation increases risks of over-permissive policies, which is a security concern. The error messages indicate content loss rather than intentional security guidance.

Diff

diff --git a/eks/latest/eksctl/minimum-iam-policies.md b/eks/latest/eksctl/minimum-iam-policies.md
index 721aa6b36..8e2288545 100644
--- a//eks/latest/eksctl/minimum-iam-policies.md
+++ b//eks/latest/eksctl/minimum-iam-policies.md
@@ -28,36 +28 @@ An AWS Managed Policy is created and administered by AWS. You cannot change the
-    {
-        "Version": "2012-10-17",		 	 	 
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": "eks:*",
-                "Resource": "*"
-            },
-            {
-                "Action": [
-                    "ssm:GetParameter",
-                    "ssm:GetParameters"
-                ],
-                "Resource": [
-                    "arn:aws:ssm:*:<account_id>:parameter/aws/*",
-                    "arn:aws:ssm:*::parameter/aws/*"
-                ],
-                "Effect": "Allow"
-            },
-            {
-                 "Action": [
-                   "kms:CreateGrant",
-                   "kms:DescribeKey"
-                 ],
-                 "Resource": "*",
-                 "Effect": "Allow"
-            },
-            {
-                 "Action": [
-                   "logs:PutRetentionPolicy"
-                 ],
-                 "Resource": "*",
-                 "Effect": "Allow"
-            }
-        ]
-    }
+    # Error: No files found with UUID: 27ad3ff9-60be-4128-8b83-f8833a6e39aa
@@ -68,72 +33 @@ An AWS Managed Policy is created and administered by AWS. You cannot change the
-    {
-        "Version": "2012-10-17",		 	 	 
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "iam:CreateInstanceProfile",
-                    "iam:DeleteInstanceProfile",
-                    "iam:GetInstanceProfile",
-                    "iam:RemoveRoleFromInstanceProfile",
-                    "iam:GetRole",
-                    "iam:CreateRole",
-                    "iam:DeleteRole",
-                    "iam:AttachRolePolicy",
-                    "iam:PutRolePolicy",
-                    "iam:UpdateAssumeRolePolicy",
-                    "iam:AddRoleToInstanceProfile",
-                    "iam:ListInstanceProfilesForRole",
-                    "iam:PassRole",
-                    "iam:DetachRolePolicy",
-                    "iam:DeleteRolePolicy",
-                    "iam:GetRolePolicy",
-                    "iam:GetOpenIDConnectProvider",
-                    "iam:CreateOpenIDConnectProvider",
-                    "iam:DeleteOpenIDConnectProvider",
-                    "iam:TagOpenIDConnectProvider",
-                    "iam:ListAttachedRolePolicies",
-                    "iam:TagRole",
-                    "iam:UntagRole",
-                    "iam:GetPolicy",
-                    "iam:CreatePolicy",
-                    "iam:DeletePolicy",
-                    "iam:ListPolicyVersions"
-                ],
-                "Resource": [
-                    "arn:aws:iam::<account_id>:instance-profile/eksctl-*",
-                    "arn:aws:iam::<account_id>:role/eksctl-*",
-                    "arn:aws:iam::<account_id>:policy/eksctl-*",
-                    "arn:aws:iam::<account_id>:oidc-provider/*",
-                    "arn:aws:iam::<account_id>:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup",
-                    "arn:aws:iam::<account_id>:role/eksctl-managed-*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "iam:GetRole",
-                    "iam:GetUser"
-                ],
-                "Resource": [
-                    "arn:aws:iam::<account_id>:role/*",
-                    "arn:aws:iam::<account_id>:user/*"
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "iam:CreateServiceLinkedRole"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "iam:AWSServiceName": [
-                            "eks.amazonaws.com",
-                            "eks-nodegroup.amazonaws.com",
-                            "eks-fargate.amazonaws.com"
-                        ]
-                    }
-                }
-            }
-        ]
-    }
+    # Error: No files found with UUID: 5500eeb9-bf3d-498d-999b-7f8036e705a5