AWS eks documentation change

Service: eks · 2025-11-10 · Documentation medium

File: eks/latest/userguide/access-policy-permissions.md

Summary

Added AmazonEKSSecretReaderPolicy for read-only access to Kubernetes Secrets

Security assessment

The change introduces documentation for a new IAM policy granting read access to Kubernetes Secrets, which are sensitive resources. While this relates to security controls, there is no evidence of addressing a specific vulnerability. The addition provides guidance on implementing least-privilege access for secrets management.

Diff

diff --git a/eks/latest/userguide/access-policy-permissions.md b/eks/latest/userguide/access-policy-permissions.md
index eaf273050..eff04d231 100644
--- a//eks/latest/userguide/access-policy-permissions.md
+++ b//eks/latest/userguide/access-policy-permissions.md
@@ -5 +5 @@
-List all policiesAmazonEKSAdminPolicyAmazonEKSClusterAdminPolicyAmazonEKSAdminViewPolicyAmazonEKSEditPolicyAmazonEKSViewPolicyAmazonEKSAutoNodePolicyAmazonEKSBlockStoragePolicyAmazonEKSLoadBalancingPolicyAmazonEKSNetworkingPolicyAmazonEKSComputePolicyAmazonEKSBlockStorageClusterPolicyAmazonEKSComputeClusterPolicyAmazonEKSLoadBalancingClusterPolicyAmazonEKSNetworkingClusterPolicyAmazonEKSHybridPolicyAmazonEKSClusterInsightsPolicyAccess policy updates
+List all policiesAmazonEKSAdminPolicyAmazonEKSClusterAdminPolicyAmazonEKSAdminViewPolicyAmazonEKSEditPolicyAmazonEKSViewPolicyAmazonEKSSecretReaderPolicyAmazonEKSAutoNodePolicyAmazonEKSBlockStoragePolicyAmazonEKSLoadBalancingPolicyAmazonEKSNetworkingPolicyAmazonEKSComputePolicyAmazonEKSBlockStorageClusterPolicyAmazonEKSComputeClusterPolicyAmazonEKSLoadBalancingClusterPolicyAmazonEKSNetworkingClusterPolicyAmazonEKSHybridPolicyAmazonEKSClusterInsightsPolicyAccess policy updates
@@ -150,0 +151,10 @@ Kubernetes API groups | Kubernetes resources | Kubernetes verbs (permissions)
+## AmazonEKSSecretReaderPolicy
+
+This access policy includes permissions that allow an IAM principal to read [Kubernetes Secrets.](https://kubernetes.io/docs/concepts/configuration/secret/)
+
+**ARN** – ` arn:aws:eks::aws:cluster-access-policy/AmazonEKSSecretReaderPolicy`
+
+Kubernetes API groups | Kubernetes resources | Kubernetes verbs (permissions)  
+---|---|---  
+|  `secrets` |  `get`, `list`, `watch`  
+  
@@ -513,0 +524 @@ Change | Description | Date
+Add `AmazonEKSSecretReaderPolicy` |  Add a new policy for read-only access to secrets |  November 6, 2025