AWS eks medium security documentation change

Service: eks · 2026-04-10 · Security-related medium

File: eks/latest/userguide/auto-learn-iam.md

Summary

Removed entire 'Custom AWS tags for EKS Auto resources' section including detailed IAM policy example for tag propagation

Security assessment

Removal of a detailed IAM policy that granted broad permissions (including shield:CreateProtection and shield:TagResource) suggests this policy may have been overly permissive or contained security issues. The policy allowed unrestricted tagging access with conditions that could be bypassed or misconfigured, potentially leading to privilege escalation or resource misuse.

Diff

diff --git a/eks/latest/userguide/auto-learn-iam.md b/eks/latest/userguide/auto-learn-iam.md
index a3e9bc1f6..9cf5c234f 100644
--- a//eks/latest/userguide/auto-learn-iam.md
+++ b//eks/latest/userguide/auto-learn-iam.md
@@ -5 +5 @@
-Cluster IAM roleNode IAM roleService-linked roleCustom AWS tags for EKS Auto resourcesAccess Policy Reference
+Cluster IAM roleNode IAM roleService-linked roleAccess Policy Reference
@@ -120,104 +119,0 @@ For more information, see:
-## Custom AWS tags for EKS Auto resources
-
-By default, the managed policies related to EKS Auto Mode do not permit applying user defined tags to Auto Mode provisioned AWS resources. If you want to apply user defined tags to AWS resources, you must attach additional permissions to the Cluster IAM Role with sufficient permissions to create and modify tags on AWS resources. Below is an example of a policy that will allow unrestricted tagging access:
-    
-    
-    {
-        "Version":"2012-10-17",
-        "Statement": [
-            {
-                "Sid": "Compute",
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:CreateFleet",
-                    "ec2:RunInstances",
-                    "ec2:CreateLaunchTemplate"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    },
-                    "StringLike": {
-                        "aws:RequestTag/eks:kubernetes-node-class-name": "*",
-                        "aws:RequestTag/eks:kubernetes-node-pool-name": "*"
-                    }
-                }
-            },
-            {
-                "Sid": "Storage",
-                "Effect": "Allow",
-                "Action": [
-                    "ec2:CreateVolume",
-                    "ec2:CreateSnapshot"
-                ],
-                "Resource": [
-                    "arn:aws:ec2:*:*:volume/*",
-                    "arn:aws:ec2:*:*:snapshot/*"
-                ],
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    }
-                }
-            },
-            {
-                "Sid": "Networking",
-                "Effect": "Allow",
-                "Action": "ec2:CreateNetworkInterface",
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    },
-                    "StringLike": {
-                        "aws:RequestTag/eks:kubernetes-cni-node-name": "*"
-                    }
-                }
-            },
-            {
-                "Sid": "LoadBalancer",
-                "Effect": "Allow",
-                "Action": [
-                    "elasticloadbalancing:CreateLoadBalancer",
-                    "elasticloadbalancing:CreateTargetGroup",
-                    "elasticloadbalancing:CreateListener",
-                    "elasticloadbalancing:CreateRule",
-                    "ec2:CreateSecurityGroup"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    }
-                }
-            },
-            {
-                "Sid": "ShieldProtection",
-                "Effect": "Allow",
-                "Action": [
-                    "shield:CreateProtection"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    }
-                }
-            },
-            {
-                "Sid": "ShieldTagResource",
-                "Effect": "Allow",
-                "Action": [
-                    "shield:TagResource"
-                ],
-                "Resource": "arn:aws:shield::*:protection/*",
-                "Condition": {
-                    "StringEquals": {
-                        "aws:RequestTag/eks:eks-cluster-name": "${aws:PrincipalTag/eks:eks-cluster-name}"
-                    }
-                }
-            }
-        ]
-    }
-