AWS Security ChangesHomeSearch

AWS eks documentation change

Service: eks · 2026-03-07 · Documentation low

File: eks/latest/userguide/hybrid-nodes-cluster-create.md

Summary

Expanded allowed CIDR ranges to include CGNAT (100.64.0.0/10) in multiple network configuration steps

Security assessment

The change broadens network range allowances but doesn't reference security vulnerabilities. CGNAT ranges are standard carrier-grade NAT ranges, not indicative of security fixes.

Diff

diff --git a/eks/latest/userguide/hybrid-nodes-cluster-create.md b/eks/latest/userguide/hybrid-nodes-cluster-create.md
index 5c31b9c5b..a5a725cda 100644
--- a//eks/latest/userguide/hybrid-nodes-cluster-create.md
+++ b//eks/latest/userguide/hybrid-nodes-cluster-create.md
@@ -116 +116 @@ You need to install the latest version of the `eksctl` command line tool. To ins
-      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`.
+      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16` , or within the CGNAT range defined by RFC 6598: `100.64.0.0/10`.
@@ -177 +177 @@ The CloudFormation stack creates the EKS cluster IAM role and an EKS cluster wit
-      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`.
+      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`, or within the CGNAT range defined by RFC 6598: `100.64.0.0/10`.
@@ -251 +251 @@ Cluster provisioning takes several minutes. You can check the status of your sta
-      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`.
+      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`, or within the CGNAT range defined by RFC 6598: `100.64.0.0/10`.
@@ -328 +328 @@ Cluster provisioning takes several minutes. You can check the status of your sta
-      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`.
+      1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`, or within the CGNAT range defined by RFC 6598: `100.64.0.0/10`.