AWS eks documentation change
Summary
Updated policy-arn parameters in IAM attach/detach commands with correct ARN syntax
Security assessment
Fixes ARN formatting in IPv6 cluster setup/cleanup commands. No security vulnerability addressed.
Diff
diff --git a/eks/latest/userguide/deploy-ipv6-cluster.md b/eks/latest/userguide/deploy-ipv6-cluster.md index 9199677fa..6bdfb3d4e 100644 --- a//eks/latest/userguide/deploy-ipv6-cluster.md +++ b//eks/latest/userguide/deploy-ipv6-cluster.md @@ -217 +217 @@ An example output is as follows. - aws iam attach-role-policy --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSClusterPolicy --role-name $cluster_role_name + aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy --role-name $cluster_role_name @@ -296 +296 @@ By default, the `config` file is created in `~/.kube` or the new cluster’s con - aws iam attach-role-policy --policy-arn <shared id="region.arn"/>iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy \ + aws iam attach-role-policy --policy-arn arn:aws:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy \ @@ -305 +305 @@ For simplicity in this tutorial, the policy is attached to this IAM role. In a p - aws iam attach-role-policy --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSWorkerNodePolicy \ + aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy \ @@ -307 +307 @@ For simplicity in this tutorial, the policy is attached to this IAM role. In a p - aws iam attach-role-policy --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \ + aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \ @@ -394,5 +394,5 @@ Don’t proceed to the next step until your output is similar to the following o - aws iam detach-role-policy --role-name $cluster_role_name --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSClusterPolicy - aws iam detach-role-policy --role-name $node_role_name --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEKSWorkerNodePolicy - aws iam detach-role-policy --role-name $node_role_name --policy-arn <shared id="region.arn"/>iam::aws:policy/AmazonEC2ContainerRegistryReadOnly - aws iam detach-role-policy --role-name $node_role_name --policy-arn <shared id="region.arn"/>iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy - aws iam delete-policy --policy-arn <shared id="region.arn"/>iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy + aws iam detach-role-policy --role-name $cluster_role_name --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy + aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy + aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly + aws iam detach-role-policy --role-name $node_role_name --policy-arn arn:aws:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy + aws iam delete-policy --policy-arn arn:aws:iam::$account_id:policy/AmazonEKS_CNI_IPv6_Policy