AWS eks medium security documentation change

Service: eks · 2026-03-16 · Security-related medium

File: eks/latest/userguide/associate-service-account-role.md

Summary

Fixed ARN formatting in IAM policies and OIDC provider references

Security assessment

Correct ARN formatting ensures proper IAM policy enforcement. Incorrect ARNs could lead to privilege escalation risks if policies reference invalid resources.

Diff

diff --git a/eks/latest/userguide/associate-service-account-role.md b/eks/latest/userguide/associate-service-account-role.md
index a80c935f5..3b62bc35d 100644
--- a//eks/latest/userguide/associate-service-account-role.md
+++ b//eks/latest/userguide/associate-service-account-role.md
@@ -46 +46 @@ You can run the following command to create an example policy file that allows r
-                "Resource": "&region-arn;s3:::my-pod-secrets-bucket"
+                "Resource": "arn:aws:s3:::my-pod-secrets-bucket"
@@ -110 +110 @@ If you have an existing Kubernetes service account that you want to assume an IA
-            "Federated": "&region-arn;iam::123456789012:oidc-provider/$oidc_provider"
+            "Federated": "arn:aws:iam::123456789012:oidc-provider/$oidc_provider"
@@ -154 +154 @@ An example output is as follows.
-                    "Federated": "&region-arn;iam::111122223333:oidc-provider/oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
+                    "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
@@ -159,2 +159,2 @@ An example output is as follows.
-                        "oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:default:my-service-account",
-                        "oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
+                        "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:default:my-service-account",
+                        "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
@@ -208 +208 @@ An example output is as follows.
-                "Resource": "&region-arn;s3:::my-pod-secrets-bucket"
+                "Resource": "arn:aws:s3:::my-pod-secrets-bucket"