AWS eks documentation change
Summary
Replaced KMS key ARN placeholders with concrete examples and updated OIDC provider regions.
Security assessment
Provides accurate KMS key and OIDC provider examples, improving clarity for encryption and IAM configuration. Supports security best practices but does not fix a vulnerability.
Diff
diff --git a/eks/latest/userguide/ebs-csi.md b/eks/latest/userguide/ebs-csi.md index c1e622ecf..8836279d2 100644 --- a//eks/latest/userguide/ebs-csi.md +++ b//eks/latest/userguide/ebs-csi.md @@ -109 +109 @@ The specific steps in this procedure are written for using the driver as an Amaz - "Resource": ["custom-key-arn"], + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"], @@ -125 +125 @@ The specific steps in this procedure are written for using the driver as an Amaz - "Resource": ["custom-key-arn"] + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"] @@ -213 +213 @@ Add a comma to the end of the previous line, and then add the following line aft - "Resource": ["custom-key-arn"], + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"], @@ -229 +229 @@ Add a comma to the end of the previous line, and then add the following line aft - "Resource": ["custom-key-arn"] + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"] @@ -277 +277 @@ An example output is as follows. - "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE" + "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE" @@ -282,2 +282,2 @@ An example output is as follows. - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com", - "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa" + "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com", + "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa" @@ -316 +316 @@ An example output is as follows. - "Resource": ["custom-key-arn"], + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"], @@ -332 +332 @@ An example output is as follows. - "Resource": ["custom-key-arn"] + "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]