AWS eks documentation change
Summary
Added documentation for AmazonEKSConnectorServiceRolePolicy and updated policy details
Security assessment
Documents a new AWS-managed policy for EKS connector roles, which is a security feature. No evidence of addressing a specific vulnerability.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index 2881e0237..f65ed9fa4 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSDashboardConsoleReadOnlyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies +AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSDashboardConsoleReadOnlyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSConnectorServiceRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies @@ -98,0 +99,23 @@ To view the latest version of the JSON policy document, see [AmazonEKSFargatePod +## AWS managed policy: AmazonEKSConnectorServiceRolePolicy + +You can’t attach `AmazonEKSConnectorServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see [Using roles to connect a Kubernetes cluster to Amazon EKS](./using-service-linked-roles-eks-connector.html). + +The role allows Amazon EKS to connect Kubernetes clusters. The attached policies allow the role to manage necessary resources to connect to your registered Kubernetes cluster. + +**Permissions details** + +This policy includes the following permissions that allow Amazon EKS to complete the following tasks. + + * **`SSM Management` ** – Create, describe, and delete SSM activations, and deregister managed instances. This allows basic Systems Manager operations. + + * **`Session Management` ** – Start SSM sessions specifically for EKS clusters and execute non-interactive commands using the AmazonEKS document. + + * **`IAM Role Passing` ** – Pass IAM roles specifically to the SSM service, controlled by a condition that restricts the passed roles to `ssm.amazonaws.com`. + + * **`EventBridge Rules` ** – Create EventBridge rules and targets, but only when managed by `eks-connector.amazonaws.com`. Rules are specifically limited to AWS SSM as the event source. + + + + +To view the latest version of the JSON policy document, see [AmazonEKSConnectorServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEKSConnectorServiceRolePolicy.html) in the AWS Managed Policy Reference Guide. + @@ -461,0 +485 @@ Change | Description | Date +Added permission to [AWSServiceRoleForAmazonEKSConnector](./using-service-linked-roles-eks-connector.html) | Added `ssmmessages:OpenDataChannel` permission to `AmazonEKSConnectorServiceRolePolicy` | October 15, 2025