AWS eks medium security documentation change
Summary
Added session tag disable option and session policy configuration for Pod Identity associations
Security assessment
Enables granular permission restrictions through session policies and reduces potential credential exposure by disabling session tags, directly enhancing IAM security posture for pods.
Diff
diff --git a/eks/latest/userguide/pod-id-association.md b/eks/latest/userguide/pod-id-association.md index 0f8b6d3f7..d3eda944a 100644 --- a//eks/latest/userguide/pod-id-association.md +++ b//eks/latest/userguide/pod-id-association.md @@ -77 +77,9 @@ For a list of Amazon EKS condition keys, see [Conditions defined by Amazon Elast - 8. (Optional) For the **Tags** , choose **Add tag** to add metadata in a key and value pair. These tags are applied to the association and can be used in IAM policies. + 8. (Optional) Select **Disable session tags** to disable the default session tags that Pod Identity automatically adds when it assumes the role. + + 9. (Optional) Toggle **Configure session policy** to configure an IAM policy to apply additional restrictions to this Pod Identity association beyond the permissions defined in the IAM policy attached to the IAM role. + +###### Note + +A session policy can only be applied when the **Disable session tags** setting is checked. + + 10. (Optional) For the **Tags** , choose **Add tag** to add metadata in a key and value pair. These tags are applied to the association and can be used in IAM policies. @@ -81 +89 @@ You can repeat this step to add multiple tags. - 9. Choose **Create**. + 11. Choose **Create**.