AWS eks documentation change
Summary
Added support for Amazon S3 Files storage to the Amazon EFS CSI driver add-on, including updated IAM policy requirements and configuration instructions for S3 file systems.
Security assessment
This change adds documentation about required IAM policies (AmazonS3FilesCSIDriverPolicy) for the new S3 Files storage feature, which is a security configuration aspect. It clarifies IAM role setup for different storage types but does not address any specific security vulnerability or incident.
Diff
diff --git a/eks/latest/userguide/workloads-add-ons-available-eks.md b/eks/latest/userguide/workloads-add-ons-available-eks.md index 462afbac5..a73795df8 100644 --- a//eks/latest/userguide/workloads-add-ons-available-eks.md +++ b//eks/latest/userguide/workloads-add-ons-available-eks.md @@ -23,0 +24 @@ Provide Amazon EFS storage for your cluster | Amazon EFS CSI driver | EC2, EKS +Provide Amazon S3 Files storage for your cluster | Amazon EFS CSI driver | EC2, EKS Auto Mode @@ -143 +144 @@ To learn more about the add-on, see [Use Kubernetes volume storage with Amazon E -The Amazon EFS CSI driver Amazon EKS add-on is a Kubernetes Container Storage Interface (CSI) plugin that provides Amazon EFS storage for your cluster. +The Amazon EFS CSI driver Amazon EKS add-on is a Kubernetes Container Storage Interface (CSI) plugin that provides Amazon EFS and Amazon S3 Files storage for your cluster. @@ -149 +150,14 @@ The Amazon EKS add-on name is `aws-efs-csi-driver`. -**Required IAM permissions** – This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. For more information, see [IAM roles for service accounts](./iam-roles-for-service-accounts.html). The permissions in the [AmazonEFSCSIDriverPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEFSCSIDriverPolicy.html) AWS managed policy are required. You can create an IAM role and attach the managed policy to it with the following commands. Replace `my-cluster` with the name of your cluster and `AmazonEKS_EFS_CSI_DriverRole` with the name for your role. These commands require that you have [eksctl](https://eksctl.io) installed on your device. If you need to use a different tool, see [Step 1: Create an IAM role](./efs-csi.html#efs-create-iam-resources). +This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. For more information, see [IAM roles for service accounts](./iam-roles-for-service-accounts.html). + +The specific AWS managed policy you need depends on which file system type you want to use: + + * **For Amazon EFS file systems only** : Attach the [AmazonEFSCSIDriverPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEFSCSIDriverPolicy.html) managed policy. + + * **For Amazon S3 file system only** : Attach the `AmazonS3FilesCSIDriverPolicy` managed policy. + + * **For both Amazon EFS and Amazon S3 file systems** : Attach both the `AmazonEFSCSIDriverPolicy` and `AmazonS3FilesCSIDriverPolicy` managed policies. + + + + +You can create an IAM role and attach the managed policy to it with the following commands. Replace `my-cluster` with the name of your cluster and `AmazonEKS_EFS_CSI_DriverRole` with the name for your role. The following example attaches the `AmazonEFSCSIDriverPolicy` for Amazon EFS file systems. If you’re using an Amazon S3 file system, replace the policy ARN with ` arn:aws:iam::aws:policy/service-role/AmazonS3FilesCSIDriverPolicy`. If you’re using both file system types, add an additional `--attach-policy-arn` flag with the second policy ARN. These commands require that you have [eksctl](https://eksctl.io) installed on your device. If you need to use a different tool, see [Step 1: Create an IAM role](./efs-csi.html#efs-create-iam-resources) for Amazon EFS or [Step 1: Create an IAM role](./s3files-csi.html#s3files-create-iam-resources) for Amazon S3 Files. @@ -165,0 +180,4 @@ The Amazon EKS add-on name is `aws-efs-csi-driver`. +###### Note + +The above example only configures `efs-csi-controller-sa`. If you are using Amazon S3 file systems, you also need to configure `efs-csi-node-sa`. See [Step 1: Create an IAM role](./s3files-csi.html#s3files-create-iam-resources) for the complete S3 Files IAM setup. +