AWS eks medium security documentation change

Service: eks · 2026-02-13 · Security-related medium

File: eks/latest/userguide/create-node-class.md

Summary

Added documentation for 'enableV4Egress' configuration to disable IPv4 egress from IPv6 pods

Security assessment

Explicitly addresses security gap where IPv4 traffic bypasses Network Policies in IPv6 clusters. New feature prevents unintended traffic exposure by disabling IPv4 interfaces not secured by network policies.

Diff

diff --git a/eks/latest/userguide/create-node-class.md b/eks/latest/userguide/create-node-class.md
index ebd31ecd1..6f6fa53d4 100644
--- a//eks/latest/userguide/create-node-class.md
+++ b//eks/latest/userguide/create-node-class.md
@@ -5 +5 @@
-Create a Node ClassCreate node class access entryNode Class SpecificationConsiderationsSubnet selection for PodsSecondary IP Mode for Pods
+Create a Node ClassCreate node class access entryNode Class SpecificationConsiderationsSubnet selection for PodsSecondary IP Mode for PodsDisable IPv4 egress from IPv6 pods in IPv6 clusters.
@@ -201,0 +202,3 @@ For information about deploying CloudFormation stacks, see [Getting started with
+        # enableV4Egress is default to true. Setting it to false when using network policy or blocking IPv4 traffic in IPv6 clusters
+        enableV4Egress: false
+    
@@ -346,0 +350,35 @@ Use `ipv4PrefixSize` when you need to:
+## Disable IPv4 egress from IPv6 pods in IPv6 clusters.
+
+The `enableV4Egress` fields is true by default. For Auto Mode IPv6 clusters, the feature can be disabled and thus Auto Mode won’t create an egress only IPv4 interface for IPv6 pods. This is important because the IPv4 network interface will not be secured by the Network policy feature. Network policies will only be enforced on the Pod’s primary interface (i.e.,) eth0.
+
+### Use cases
+
+Use `enableV4Egress` when you need to:
+
+  * **Use IPv6 Cluster** : IPv4 egress traffic is allowed by default.
+
+  * **Use Network Policy** : Currently EKS network policy isn’t supporting dual stack. Disabling the v4Egress can protect pods' traffic being egressed from pods unexpectedly.
+
+
+
+
+### Example configuration
+    
+    
+    apiVersion: eks.amazonaws.com/v1
+    kind: NodeClass
+    metadata:
+      name: advanced-networking
+    spec:
+      role: MyNodeRole
+    
+      advancedNetworking:
+        enableV4Egress: false
+
+### Considerations for disabling enableV4Egress
+
+  * **Network Policy in IPv6 Cluster** : IPv6 clusters allow IPv4 traffic by default. Setting `enableV4Egress: false` blocks IPv4 egress traffic, providing enhanced security especially when used with Network Policies.
+
+
+
+