AWS eks documentation change
Summary
Added troubleshooting guidance for missing 'eks:ListAccessEntries' permissions and updated error examples
Security assessment
The change explains how missing 'eks:ListAccessEntries' permissions can lead to 403 errors and requires using '--skip cluster-access-validation'. While this highlights security-related configuration consequences, it does not fix a vulnerability. It provides documentation to avoid misconfigurations that could weaken security.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-troubleshooting.md b/eks/latest/userguide/hybrid-nodes-troubleshooting.md index 5b759038a..db5a43fa6 100644 --- a//eks/latest/userguide/hybrid-nodes-troubleshooting.md +++ b//eks/latest/userguide/hybrid-nodes-troubleshooting.md @@ -65 +65 @@ When running `nodeadm init`, if you see errors related to `operation error` or ` -When running `nodeadm init`, `nodeadm` attempts to gather information about your EKS cluster by calling Describe Cluster. If your Hybrid Nodes IAM role does not have permission for the `eks:DescribeCluster` action. For more information on the required permissions for the Hybrid Nodes IAM role, see [Prepare credentials for hybrid nodes](./hybrid-nodes-creds.html). +When running `nodeadm init`, `nodeadm` attempts to gather information about your EKS cluster by calling the EKS `DescribeCluster` action. If your Hybrid Nodes IAM role does not have permission for the `eks:DescribeCluster` action, then you must pass your Kubernetes API endpoint, cluster CA bundle, and service IPv4 CIDR in the node configuration you pass to `nodeadm` when you run `nodeadm init`. For more information on the required permissions for the Hybrid Nodes IAM role, see [Prepare credentials for hybrid nodes](./hybrid-nodes-creds.html). @@ -69,0 +70,7 @@ When running `nodeadm init`, `nodeadm` attempts to gather information about your +**Hybrid Nodes IAM role missing permissions for the`eks:ListAccessEntries` action** + +When running `nodeadm init`, `nodeadm` attempts to validate whether your EKS cluster has an access entry of type `HYBRID_LINUX` associated with the Hybrid Nodes IAM role by calling the EKS `ListAccessEntries` action. If your Hybrid Nodes IAM role does not have permission for the `eks:ListAccessEntries` action, then you must pass the `--skip cluster-access-validation` flag when you run the `nodeadm init` command. For more information on the required permissions for the Hybrid Nodes IAM role, see [Prepare credentials for hybrid nodes](./hybrid-nodes-creds.html). + + + "msg":"Command failed","error":"operation error EKS: ListAccessEntries, https response error StatusCode: 403 ... AccessDeniedException" +