AWS eks documentation change

Service: eks · 2026-01-25 · Documentation low

File: eks/latest/userguide/cni-custom-network-tutorial.md

Summary

Fixed incorrect ARN syntax in IAM policy attachment/detachment commands throughout the document

Security assessment

Changes correct ARN formatting errors but don't address any security vulnerability. Incorrect ARNs could cause deployment failures but don't directly create security risks.

Diff

diff --git a/eks/latest/userguide/cni-custom-network-tutorial.md b/eks/latest/userguide/cni-custom-network-tutorial.md
index 18cdd58fc..82a849ba8 100644
--- a//eks/latest/userguide/cni-custom-network-tutorial.md
+++ b//eks/latest/userguide/cni-custom-network-tutorial.md
@@ -95 +95 @@ Don’t continue to the next step until the output of the command is `CREATE_COM
-                aws iam attach-role-policy --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSClusterPolicy --role-name myCustomNetworkingAmazonEKSClusterRole
+                aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy --role-name myCustomNetworkingAmazonEKSClusterRole
@@ -102 +102 @@ Don’t continue to the next step until the output of the command is `CREATE_COM
-           --role-arn <shared id="region.arn"/>iam::$account_id:role/myCustomNetworkingAmazonEKSClusterRole \
+           --role-arn arn:aws:iam::$account_id:role/myCustomNetworkingAmazonEKSClusterRole \
@@ -332 +332 @@ If output is returned, the annotation exists. If no output is returned, then the
-          --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSWorkerNodePolicy \
+          --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy \
@@ -335 +335 @@ If output is returned, the annotation exists. If no output is returned, then the
-          --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
+          --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
@@ -338 +338 @@ If output is returned, the annotation exists. If no output is returned, then the
-            --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKS_CNI_Policy \
+            --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy \
@@ -481,3 +481,3 @@ Don’t continue until the returned output is similar to the following output.
-                aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSWorkerNodePolicy
-        aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
-        aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKS_CNI_Policy
+                aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
+        aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
+        aws iam detach-role-policy --role-name myCustomNetworkingNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
@@ -505 +505 @@ When output similar to the following is returned, the cluster is successfully de
-                aws iam detach-role-policy --role-name myCustomNetworkingAmazonEKSClusterRole --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSClusterPolicy
+                aws iam detach-role-policy --role-name myCustomNetworkingAmazonEKSClusterRole --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy