AWS guardduty documentation change
Summary
Added documentation for the new 'disableCpuLimits' parameter for GuardDuty security agent EKS add-on, allowing CPU limits to be disabled for the security agent pod
Security assessment
This change documents a new configuration parameter for the GuardDuty security agent that allows disabling CPU limits. While this relates to security monitoring infrastructure, there is no evidence in the diff that this addresses a specific security vulnerability or incident. The change appears to be a feature enhancement providing more flexibility in resource allocation for security monitoring pods.
Diff
diff --git a/guardduty/latest/ug/guardduty-configure-security-agent-eks-addon.md b/guardduty/latest/ug/guardduty-configure-security-agent-eks-addon.md index e831ba682..417e8a734 100644 --- a//guardduty/latest/ug/guardduty-configure-security-agent-eks-addon.md +++ b//guardduty/latest/ug/guardduty-configure-security-agent-eks-addon.md @@ -39 +39,11 @@ Requests | 200m | Between 200m and 10000m, both inclusive -Limits | 1000m +Limits | 1000m | Between 200m and 10000m, both inclusive +`disableCpuLimits` | `false` | `true` or `false` + +The `disableCpuLimits` parameter is available for GuardDuty security agent version 1.12.1-eksbuild.3 and later. On earlier versions, the add-on does not support this parameter, and the Amazon EKS add-on APIs (`CreateAddon`, `UpdateAddon`) return a validation error if you specify it. + +When you set `disableCpuLimits` to `true`, the security agent pod does not enforce a CPU limit. Other resource settings are unaffected. + +To disable CPU limits, use the following configuration: + + + {"resources":{"disableCpuLimits":true}}