AWS eks medium security documentation change
Summary
Updated documentation for EKS worker node launch process including AMI version updates, new configuration parameters (ApiServerEndpoint, CertificateAuthorityData, ServiceCidr, AuthenticationMode), removal of IMDSv1 disable guidance, and authentication mode-specific instructions.
Security assessment
The removal of the 'DisableIMDSv1' guidance eliminates a security best practice recommendation, potentially leaving nodes vulnerable to SSRF attacks if IMDSv1 remains enabled. The addition of AuthenticationMode documentation and updated security advisory links for Amazon Linux 2023 adds security-related configuration guidance.
Diff
diff --git a/eks/latest/userguide/launch-workers.md b/eks/latest/userguide/launch-workers.md index a9ea84f50..72d9ee2f2 100644 --- a//eks/latest/userguide/launch-workers.md +++ b//eks/latest/userguide/launch-workers.md @@ -109 +109 @@ For more information, see [Restrict access to the instance profile assigned to t - curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2022-12-23/amazon-eks-nodegroup.yaml + curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2025-11-26/amazon-eks-nodegroup.yaml @@ -140,0 +141,8 @@ The following steps show one operation to retrieve the applicable group. + * **ApiServerEndpoint** : Enter the API Server Endpoint for your EKS Cluster. This can be found in the Details section of the EKS Cluster Console + + * **CertificateAuthorityData** : Enter the base64 encoded Certificate Authority data which can also be found in the EKS Cluster Console’s Deatils section. + + * **ServiceCidr** : Enter the CIDR range used for allocating IP addresses to Kubernetes services within the cluster. This is found within the networking tab of the EKS Cluster Console. + + * **AuthenticationMode** : Select the Authentication Mode in use in the EKS Cluster by reviewing the access tab within the EKS Cluster Console. + @@ -151 +159 @@ The following steps show one operation to retrieve the applicable group. - * **NodeImageIdSSMParam** : Pre-populated with the Amazon EC2 Systems Manager parameter of a recent Amazon EKS optimized AMI for a variable Kubernetes version. To use a different Kubernetes minor version supported with Amazon EKS, replace `1.XX` with a different [supported version](https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html). We recommend specifying the same Kubernetes version as your cluster. + * **NodeImageIdSSMParam** : Pre-populated with the Amazon EC2 Systems Manager parameter of a recent Amazon EKS optimized Amazon Linux 2023 AMI for a variable Kubernetes version. To use a different Kubernetes minor version supported with Amazon EKS, replace `1.XX` with a different [supported version](https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html). We recommend specifying the same Kubernetes version as your cluster. @@ -153 +161 @@ The following steps show one operation to retrieve the applicable group. -You can also replace `amazon-linux-2` with a different AMI type. For more information, see [Retrieve recommended Amazon Linux AMI IDs](./retrieve-ami-id.html). +You can also replace `amazon-linux-2023` with a different AMI type. For more information, see [Retrieve recommended Amazon Linux AMI IDs](./retrieve-ami-id.html). @@ -157 +165 @@ You can also replace `amazon-linux-2` with a different AMI type. For more inform -The Amazon EKS node AMIs are based on Amazon Linux. You can track security or privacy events for Amazon Linux 2 at the [Amazon Linux Security Center](https://alas.aws.amazon.com/alas2.html) or subscribe to the associated [RSS feed](https://alas.aws.amazon.com/AL2/alas.rss). Security and privacy events include an overview of the issue, what packages are affected, and how to update your instances to correct the issue. +The Amazon EKS node AMIs are based on Amazon Linux. You can track security or privacy events for Amazon Linux 2023 at the [Amazon Linux Security Center](https://alas.aws.amazon.com/alas2023.html) or subscribe to the associated [RSS feed](https://alas.aws.amazon.com/AL2023/alas.rss). Security and privacy events include an overview of the issue, what packages are affected, and how to update your instances to correct the issue. @@ -167,18 +174,0 @@ The Amazon EKS node AMIs are based on Amazon Linux. You can track security or pr -###### Note - -If you don’t provide a key pair here, the AWS CloudFormation stack creation fails. - - * **BootstrapArguments** : Specify any optional arguments to pass to the node bootstrap script, such as extra `kubelet` arguments. For more information, view the [bootstrap script usage information](https://github.com/awslabs/amazon-eks-ami/blob/main/templates/al2/runtime/bootstrap.sh) on GitHub. - -To deploy a node group that: - - * can assign a significantly higher number of IP addresses to Pods than the default configuration, see [Assign more IP addresses to Amazon EKS nodes with prefixes](./cni-increase-ip-addresses.html). - - * can assign `IPv4` addresses to Pods from a different CIDR block than that of the instance, see [Deploy Pods in alternate subnets with custom networking](./cni-custom-network.html). - - * can assign `IPv6` addresses to Pods and services, see [Learn about IPv6 addresses to clusters, Pods, and services](./cni-ipv6.html). - - * don’t have outbound internet access, see [Deploy private clusters with limited internet access](./private-clusters.html). - - * **DisableIMDSv1** : By default, each node supports the Instance Metadata Service Version 1 (IMDSv1) and IMDSv2. You can disable IMDSv1. To prevent future nodes and Pods in the node group from using MDSv1, set **DisableIMDSv1** to **true**. For more information about IMDS, see [Configuring the instance metadata service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). For more information about restricting access to it on your nodes, see [Restrict access to the instance profile assigned to the worker node](https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node). - @@ -201 +191 @@ To deploy a node group that: - 11. When your stack has finished creating, select it in the console and choose **Outputs**. + 11. When your stack has finished creating, select it in the console and choose **Outputs**. If you are using the `EKS API` or `EKS API and ConfigMap` Authentication Modes, this is the last step. @@ -203 +193 @@ To deploy a node group that: - 12. Record the **NodeInstanceRole** for the node group that was created. You need this when you configure your Amazon EKS nodes. + 12. If you are using the `ConfigMap` Authentication Mode, record the **NodeInstanceRole** for the node group that was created. @@ -212 +202 @@ To deploy a node group that: -If you launched nodes inside a private VPC without outbound internet access, make sure to enable nodes to join your cluster from within the VPC. +The following two steps are only needed if using the Configmap Authentication Mode within the EKS Cluster. Additionally, if you launched nodes inside a private VPC without outbound internet access, make sure to enable nodes to join your cluster from within the VPC.