AWS AmazonCloudWatch documentation change
Summary
Updated Kubernetes RBAC permissions for CloudWatch agent, adding a namespace-scoped Role for ConfigMap operations in the 'amazon-cloudwatch' namespace and modifying ClusterRole permissions (added 'get' verb for nodes, removed 'configmaps' from cluster-scoped resources, and removed 'update' verb for endpoints).
Security assessment
The change refines Kubernetes RBAC permissions to follow the principle of least privilege by separating cluster-scoped and namespace-scoped permissions. It adds security documentation about required permissions but does not indicate a specific security vulnerability was addressed.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-metrics.md b/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-metrics.md index 57cb2ca05..32c3c0e79 100644 --- a//AmazonCloudWatch/latest/monitoring/Container-Insights-setup-metrics.md +++ b//AmazonCloudWatch/latest/monitoring/Container-Insights-setup-metrics.md @@ -52 +52,3 @@ Use one of the following methods to create a service account for the CloudWatch -If you didn't follow the previous steps, but you already have a service account for the CloudWatch agent that you want to use, you must ensure that it has the following rules. Additionally, in the rest of the steps in the Container Insights installation, you must use the name of that service account instead of `cloudwatch-agent`. +If you didn't follow the previous steps, but you already have a service account for the CloudWatch agent that you want to use, you must ensure that it has the following rules. Additionally, in the rest of the steps in the Container Insights installation, you must use the name of that service account instead of `cloudwatch-agent`. The CloudWatch agent requires a ClusterRole for cluster-wide access and a namespace-scoped role for ConfigMap operations in the `amazon-cloudwatch` namespace. + +**ClusterRole (cluster-scoped permissions):** @@ -61 +63 @@ If you didn't follow the previous steps, but you already have a service account - verbs: [ "list", "watch" ] + verbs: ["list", "watch", "get"] @@ -72 +74 @@ If you didn't follow the previous steps, but you already have a service account - resources: ["nodes/stats", "configmaps", "events"] + resources: ["nodes/stats", "events"] @@ -76,2 +78 @@ If you didn't follow the previous steps, but you already have a service account - resourceNames: ["cwagent-clusterleader"] - verbs: ["get","update"] + verbs: ["get"] @@ -84,0 +86,9 @@ If you didn't follow the previous steps, but you already have a service account +**Role (namespace-scoped permissions for amazon-cloudwatch namespace):** + + + rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["create", "update"] + +