AWS eks documentation change
Summary
Added documentation for AWS Secrets Store CSI Driver provider add-on with IAM configuration details
Security assessment
Documents secure secrets management implementation using IAM Roles for Service Accounts (IRSA) and Pod Identity, which is a security-focused feature but does not indicate remediation of a specific vulnerability. The guidance improves security practices for secret handling.
Diff
diff --git a/eks/latest/userguide/workloads-add-ons-available-eks.md b/eks/latest/userguide/workloads-add-ons-available-eks.md index ed8a2790c..8d5c250e4 100644 --- a//eks/latest/userguide/workloads-add-ons-available-eks.md +++ b//eks/latest/userguide/workloads-add-ons-available-eks.md @@ -37,0 +38 @@ Generate Prometheus metrics about SR-IOV network device performance | SR-IOV Ne +Retrieve secrets from AWS Secrets Manager and parameters from AWS Systems Manager Parameter Store and mount them as files in Kubernetes pods. | AWS Secrets Store CSI Driver provider | EC2, EKS Auto Mode, EKS Hybrid Nodes @@ -482,0 +484,18 @@ Custom IAM permissions | None +### AWS Secrets Store CSI Driver provider + +The AWS provider for the Secrets Store CSI Driver is an add-on that enables retrieving secrets from AWS Secrets Manager and parameters from AWS Systems Manager Parameter Store and mounting them as files in Kubernetes pods. + +### Required IAM permissions + +The add-on does not require IAM permissions. However, application pods will require IAM permissions to fetch secrets from AWS Secrets Manager and parameters from AWS Systems Manager Parameter Store. After installing the add-on, access must be configured via IAM Roles for Service Accounts (IRSA) or EKS Pod Identity. To use IRSA, please refer to the Secrets Manager [IRSA setup documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_ascp_irsa.html). To use EKS Pod Identity, please refer to the Secrets Manager [Pod Identity setup documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/ascp-pod-identity-integration.html). + +AWS suggests the `AWSSecretsManagerClientReadOnlyAccess` [managed policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-policies.html#security-iam-awsmanpol-AWSSecretsManagerClientReadOnlyAccess). + +For more information about the required permissions, see `AWSSecretsManagerClientReadOnlyAccess` in the AWS Managed Policy Reference. + +### Additional information + +For more information, please see the secrets-store-csi-driver-provider-aws [GitHub repository](https://github.com/aws/secrets-store-csi-driver-provider-aws). + +To learn more about the add-on, please refer to the [AWS Secrets Manager documentation for the add-on](https://docs.aws.amazon.com/secretsmanager/latest/userguide/ascp-eks-installation.html). +