AWS eks high security documentation change

Service: eks · 2026-03-16 · Security-related high

File: eks/latest/userguide/ebs-csi.md

Summary

Updated KMS key ARNs and OIDC provider references

Security assessment

Correct KMS ARNs ensure proper encryption key usage. Explicit OIDC provider references enhance pod identity security. Adds security documentation for storage encryption.

Diff

diff --git a/eks/latest/userguide/ebs-csi.md b/eks/latest/userguide/ebs-csi.md
index 50a4da5c6..4eb47d7e5 100644
--- a//eks/latest/userguide/ebs-csi.md
+++ b//eks/latest/userguide/ebs-csi.md
@@ -109 +109 @@ The specific steps in this procedure are written for using the driver as an Amaz
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
@@ -125 +125 @@ The specific steps in this procedure are written for using the driver as an Amaz
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
@@ -213 +213 @@ Add a comma to the end of the previous line, and then add the following line aft
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
@@ -229 +229 @@ Add a comma to the end of the previous line, and then add the following line aft
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
@@ -277 +277 @@ An example output is as follows.
-                    "Federated": "&region-arn;iam::111122223333:oidc-provider/oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
+                    "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
@@ -282,2 +282,2 @@ An example output is as follows.
-                      "oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com",
-                      "oidc.eks.&region_api_default;.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa"
+                      "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com",
+                      "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa"
@@ -316 +316 @@ An example output is as follows.
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"],
@@ -332 +332 @@ An example output is as follows.
-                  "Resource": ["&region-arn;kms:&region_api_default;:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
+                  "Resource": ["arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"]