AWS eks documentation change
Summary
Corrected Kubernetes username case sensitivity in ClusterRoleBinding example (from 'kro' to 'KRO'), updated pattern documentation to reflect uppercase session name, and enhanced VPC endpoint description to explicitly include CLI access.
Security assessment
Case correction prevents potential misconfiguration but isn't tied to a specific vulnerability. Enhanced VPC endpoint documentation explicitly covers CLI access, improving security feature documentation for private network access.
Diff
diff --git a/eks/latest/userguide/capabilities-security.md b/eks/latest/userguide/capabilities-security.md index cde172b89..d1ab4c6b7 100644 --- a//eks/latest/userguide/capabilities-security.md +++ b//eks/latest/userguide/capabilities-security.md @@ -155 +155 @@ Create a `ClusterRoleBinding` that grants the capability’s Kubernetes user the - name: arn:aws:sts::111122223333:assumed-role/my-kro-role/kro + name: arn:aws:sts::111122223333:assumed-role/my-kro-role/KRO @@ -164 +164 @@ Create a `ClusterRoleBinding` that grants the capability’s Kubernetes user the -The Kubernetes user name for kro follows the pattern: `arn:aws:sts::ACCOUNT_ID:assumed-role/ROLE_NAME/kro` +The Kubernetes user name for kro follows the pattern: `arn:aws:sts::ACCOUNT_ID:assumed-role/ROLE_NAME/KRO` @@ -166 +166 @@ The Kubernetes user name for kro follows the pattern: `arn:aws:sts::ACCOUNT_ID:a -The session name `/kro` is automatically set by the EKS kro capability. +The session name `/KRO` (uppercase) is automatically set by the EKS kro capability. @@ -281 +281 @@ Enable CloudTrail logging to track: -You can restrict access to the Argo CD API server by associating one or more VPC endpoints with the hosted Argo CD endpoint. This enables private connectivity to the Argo CD UI and API from within your VPC without traversing the public internet. +You can restrict access to the Argo CD API server by associating one or more VPC endpoints with the hosted Argo CD endpoint. This enables private connectivity from within your VPC without traversing the public internet. The VPC endpoint provides access to both the Argo CD web UI and the Argo CD API (including CLI access).