AWS eks documentation change
Summary
Added 'ec2:LockSnapshot' permission to AmazonEBSCSIDriverPolicy documentation and updated policy changelog.
Security assessment
Documents new security capability (snapshot locking) to prevent unauthorized deletion. No vulnerability fix implied; proactively enhances data protection.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index 3c252f028..1538f3be1 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -449 +449 @@ To view the latest version of the JSON policy document, see [AmazonEKSDashboardS -The `AmazonEBSCSIDriverPolicy` policy allows the Amazon EBS Container Storage Interface (CSI) driver to create, modify, copy, attach, detach, and delete volumes on your behalf. This includes modifying tags on existing volumes and enabling Fast Snapshot Restore (FSR) on EBS volumes. It also grants the EBS CSI driver permissions to create, restore, and delete snapshots, and to list your instances, volumes, and snapshots. +The `AmazonEBSCSIDriverPolicy` policy allows the Amazon EBS Container Storage Interface (CSI) driver to create, modify, copy, attach, detach, and delete volumes on your behalf. This includes modifying tags on existing volumes and enabling Fast Snapshot Restore (FSR) on EBS volumes. It also grants the EBS CSI driver permissions to create, lock, restore, and delete snapshots, and to list your instances, volumes, and snapshots. @@ -511,0 +512 @@ Change | Description | Date +Added permissions to AmazonEBSCSIDriverPolicy. | Added `ec2:LockSnapshot` permission to allow the EBS CSI Driver to lock EBS Snapshots directly. | January 15, 2026