AWS eks documentation change
Summary
Fixed ARN syntax in AWS IAM role/user examples and ConfigMap configuration samples
Security assessment
Replaces invalid ARN placeholders with proper IAM ARN formats across command examples and YAML snippets. While correct ARNs are essential for functional RBAC, the change doesn't mitigate a specific security vulnerability or document new security features. It prevents misconfiguration but isn't a security patch.
Diff
diff --git a/eks/latest/userguide/auth-configmap.md b/eks/latest/userguide/auth-configmap.md index 6716d4815..cdbfdd569 100644 --- a//eks/latest/userguide/auth-configmap.md +++ b//eks/latest/userguide/auth-configmap.md @@ -60 +60 @@ An example output is as follows. - rolearn: <shared id="region.arn"/>iam::111122223333:role/my-node-role + rolearn: arn:aws:iam::111122223333:role/my-node-role @@ -160 +160 @@ An example output is as follows. - <shared id="region.arn"/>iam::111122223333:role/eksctl-my-cluster-my-nodegroup-NodeInstanceRole-1XLS7754U3ZPA system:node:{{EC2PrivateDNSName}} system:bootstrappers,system:nodes + arn:aws:iam::111122223333:role/eksctl-my-cluster-my-nodegroup-NodeInstanceRole-1XLS7754U3ZPA system:node:{{EC2PrivateDNSName}} system:bootstrappers,system:nodes @@ -165 +165 @@ An example output is as follows. - --arn <shared id="region.arn"/>iam::111122223333:role/my-role --username admin --group eks-console-dashboard-full-access-group \ + --arn arn:aws:iam::111122223333:role/my-role --username admin --group eks-console-dashboard-full-access-group \ @@ -180 +180 @@ An example output is as follows. - --arn <shared id="region.arn"/>iam::111122223333:user/my-user --username my-user --group eks-console-dashboard-restricted-access-group \ + --arn arn:aws:iam::111122223333:user/my-user --username my-user --group eks-console-dashboard-restricted-access-group \ @@ -186 +186 @@ An example output is as follows. - 2022-05-09 14:53:48 [ℹ] adding identity "<shared id="region.arn"/>iam::111122223333:user/my-user" to auth ConfigMap + 2022-05-09 14:53:48 [ℹ] adding identity "arn:aws:iam::111122223333:user/my-user" to auth ConfigMap @@ -195,3 +195,3 @@ An example output is as follows. - <shared id="region.arn"/>iam::111122223333:role/eksctl-my-cluster-my-nodegroup-NodeInstanceRole-1XLS7754U3ZPA system:node:{{EC2PrivateDNSName}} system:bootstrappers,system:nodes - <shared id="region.arn"/>iam::111122223333:role/admin my-role eks-console-dashboard-full-access-group - <shared id="region.arn"/>iam::111122223333:user/my-user my-user eks-console-dashboard-restricted-access-group + arn:aws:iam::111122223333:role/eksctl-my-cluster-my-nodegroup-NodeInstanceRole-1XLS7754U3ZPA system:node:{{EC2PrivateDNSName}} system:bootstrappers,system:nodes + arn:aws:iam::111122223333:role/admin my-role eks-console-dashboard-full-access-group + arn:aws:iam::111122223333:user/my-user my-user eks-console-dashboard-restricted-access-group @@ -248 +248 @@ Add or remove lines as necessary and replace all example values with your own va - rolearn: <shared id="region.arn"/>iam::111122223333:role/my-role + rolearn: arn:aws:iam::111122223333:role/my-role @@ -252 +252 @@ Add or remove lines as necessary and replace all example values with your own va - rolearn: <shared id="region.arn"/>iam::111122223333:role/my-console-viewer-role + rolearn: arn:aws:iam::111122223333:role/my-console-viewer-role @@ -257 +257 @@ Add or remove lines as necessary and replace all example values with your own va - userarn: <shared id="region.arn"/>iam::111122223333:user/admin + userarn: arn:aws:iam::111122223333:user/admin @@ -261 +261 @@ Add or remove lines as necessary and replace all example values with your own va - userarn: <shared id="region.arn"/>iam::444455556666:user/my-user + userarn: arn:aws:iam::444455556666:user/my-user