AWS eks documentation change

Service: eks · 2026-04-10 · Documentation medium

File: eks/latest/userguide/auto-cluster-iam-role.md

Summary

Added new section 'Custom AWS tags for EKS Auto resources' with detailed IAM policy example to allow user-defined tagging on EKS Auto Mode provisioned resources

Security assessment

This adds documentation about security features (IAM policies for resource tagging). The policy includes security-relevant conditions that restrict tagging based on cluster name and other tags, which helps prevent unauthorized resource tagging. However, there's no evidence this addresses a specific security vulnerability or incident - it appears to be new feature documentation.

Diff

diff --git a/eks/latest/userguide/auto-cluster-iam-role.md b/eks/latest/userguide/auto-cluster-iam-role.md
index c89a18cea..c3ac5cdd3 100644
--- a//eks/latest/userguide/auto-cluster-iam-role.md
+++ b//eks/latest/userguide/auto-cluster-iam-role.md
@@ -5 +5 @@
-Check for an existing cluster roleCreating the Amazon EKS cluster role
+Custom AWS tags for EKS Auto resourcesCheck for an existing cluster roleCreating the Amazon EKS cluster role
@@ -29,0 +30,104 @@ Before you can create Amazon EKS clusters, you must create an IAM role with the
+## Custom AWS tags for EKS Auto resources
+
+By default, the managed policies related to EKS Auto Mode do not permit applying user defined tags to Auto Mode provisioned AWS resources. If you want to apply user defined tags to AWS resources, you must attach additional permissions to the Cluster IAM Role with sufficient permissions to create and modify tags on AWS resources. Below is an example of a policy that will allow unrestricted tagging access:
+    
+    
+    {
+        "Version":"2012-10-17",
+        "Statement": [
+            {
+                "Sid": "Compute",
+                "Effect": "Allow",
+                "Action": [
+                    "ec2:CreateFleet",
+                    "ec2:RunInstances",
+                    "ec2:CreateLaunchTemplate"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    },
+                    "StringLike": {
+                        "aws:RequestTag/eks:kubernetes-node-class-name": "*",
+                        "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
+                    }
+                }
+            },
+            {
+                "Sid": "Storage",
+                "Effect": "Allow",
+                "Action": [
+                    "ec2:CreateVolume",
+                    "ec2:CreateSnapshot"
+                ],
+                "Resource": [
+                    "arn:aws:ec2:*:*:volume/*",
+                    "arn:aws:ec2:*:*:snapshot/*"
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    }
+                }
+            },
+            {
+                "Sid": "Networking",
+                "Effect": "Allow",
+                "Action": "ec2:CreateNetworkInterface",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    },
+                    "StringLike": {
+                        "aws:RequestTag/eks:kubernetes-cni-node-name": "*"
+                    }
+                }
+            },
+            {
+                "Sid": "LoadBalancer",
+                "Effect": "Allow",
+                "Action": [
+                    "elasticloadbalancing:CreateLoadBalancer",
+                    "elasticloadbalancing:CreateTargetGroup",
+                    "elasticloadbalancing:CreateListener",
+                    "elasticloadbalancing:CreateRule",
+                    "ec2:CreateSecurityGroup"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    }
+                }
+            },
+            {
+                "Sid": "ShieldProtection",
+                "Effect": "Allow",
+                "Action": [
+                    "shield:CreateProtection"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    }
+                }
+            },
+            {
+                "Sid": "ShieldTagResource",
+                "Effect": "Allow",
+                "Action": [
+                    "shield:TagResource"
+                ],
+                "Resource": "arn:aws:shield::*:protection/*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
+                    }
+                }
+            }
+        ]
+    }
+