AWS eks medium security documentation change
Summary
Updated IAM role configuration for Amazon EFS CSI driver from a single role to separate controller and node roles with distinct permissions, including detailed setup instructions for eksctl, AWS Console, and AWS CLI.
Security assessment
The change introduces a security improvement by implementing the principle of least privilege through role separation. Previously, a single IAM role with broad permissions was used for both controller and node components. Now, the controller role only gets 'AmazonS3FilesCSIDriverPolicy' while the node role gets more restrictive 'AmazonS3ReadOnlyAccess' and 'AmazonElasticFileSystemsUtils'. This reduces the attack surface by limiting node permissions to read-only S3 access and logging utilities only. The note about 'AmazonS3ReadOnlyAccess' granting access to all S3 buckets and recommending tag-based inline policies for constrained access further demonstrates security-conscious documentation.
Diff
diff --git a/eks/latest/userguide/s3files-csi.md b/eks/latest/userguide/s3files-csi.md index 59cc35a69..7c8d9c07b 100644 --- a//eks/latest/userguide/s3files-csi.md +++ b//eks/latest/userguide/s3files-csi.md @@ -0,0 +1,2 @@ +[View a markdown version of this page](s3files-csi.md) + @@ -5 +7 @@ -ConsiderationsPrerequisitesStep 1: Create an IAM roleStep 2: Get the Amazon EFS CSI driverStep 3: Create an Amazon S3 file systemStep 4: Deploy a sample application +ConsiderationsPrerequisitesStep 1: Create IAM rolesStep 2: Get the Amazon EFS CSI driverStep 3: Create an Amazon S3 file systemStep 4: Deploy a sample application @@ -43 +45,13 @@ S3 Files is a shared file system that connects any AWS compute directly with you -## Step 1: Create an IAM role +## Step 1: Create IAM roles + +The Amazon EFS CSI driver requires IAM permissions to interact with your file system. The EFS CSI driver uses two service accounts with separate IAM roles: + + * `efs-csi-controller-sa` — used by the controller, requires `AmazonS3FilesCSIDriverPolicy`. + + * `efs-csi-node-sa` — used by the node daemonset, requires: + + * `AmazonS3ReadOnlyAccess` — enables streaming reads directly from your S3 bucket for higher throughput. + + * `AmazonElasticFileSystemsUtils` — enables publishing efs-utils logs to Amazon CloudWatch for visibility into mount operations and easier troubleshooting. + + @@ -45 +58,0 @@ S3 Files is a shared file system that connects any AWS compute directly with you -The Amazon EFS CSI driver requires IAM permissions to interact with your file system. Create an IAM role and attach the ` arn:aws:iam::aws:policy/service-role/AmazonS3FilesCSIDriverPolicy` managed policy to it. @@ -49 +62 @@ The Amazon EFS CSI driver requires IAM permissions to interact with your file sy -If you want to use both Amazon S3 file system and Amazon EFS storage, you must attach both the `AmazonS3FilesCSIDriverPolicy` and the `AmazonEFSCSIDriverPolicy` managed policies to your IAM role. For more information about Amazon EFS storage, see [Use elastic file system storage with Amazon EFS](./efs-csi.html). +If you want to use both Amazon S3 file system and Amazon EFS storage, you must attach both the `AmazonS3FilesCSIDriverPolicy` and the `AmazonEFSCSIDriverPolicy` managed policies to the controller role. For more information about Amazon EFS storage, see [Use elastic file system storage with Amazon EFS](./efs-csi.html). @@ -70 +83 @@ The specific steps in this procedure are written for using the driver as an Amaz -Run the following commands to create an IAM role and Pod Identity association with `eksctl`. Replace `my-cluster` with your cluster name, `<111122223333>` with your account ID, and `AmazonEKS_EFS_CSI_DriverRole` with a different name if desired. +Run the following commands to create IAM roles and Pod Identity associations with `eksctl`. Replace `my-cluster` with your value. @@ -74,2 +87,2 @@ Run the following commands to create an IAM role and Pod Identity association wi - export role_name=AmazonEKS_EFS_CSI_DriverRole - export account_id=111122223333 + + # Create the controller role @@ -80 +93 @@ Run the following commands to create an IAM role and Pod Identity association wi - --role-name $role_name \ + --role-name AmazonEKS_EFS_CSI_ControllerRole \ @@ -81,0 +95,2 @@ Run the following commands to create an IAM role and Pod Identity association wi + + # Create the node role @@ -86,2 +101,2 @@ Run the following commands to create an IAM role and Pod Identity association wi - --role-arn arn:aws:iam::$account_id:role/$role_name \ - --permission-policy-arns arn:aws:iam::aws:policy/service-role/AmazonS3FilesCSIDriverPolicy + --role-name AmazonEKS_EFS_CSI_NodeRole \ + --permission-policy-arns arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess,arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils @@ -91 +106 @@ Run the following commands to create an IAM role and Pod Identity association wi -Run the following commands to create an IAM role with `eksctl`. Replace `my-cluster` with your cluster name, `<111122223333>` with your account ID, and `AmazonEKS_EFS_CSI_DriverRole` with a different name if desired. +Run the following commands to create IAM roles with `eksctl`. Replace `my-cluster` with your cluster name and `region-code` with your AWS Region code. @@ -95,2 +110,4 @@ Run the following commands to create an IAM role with `eksctl`. Replace `my-clus - export role_name=AmazonEKS_EFS_CSI_DriverRole - export account_id=111122223333 + export region_code=region-code + + # Create the controller role + export controller_role_name=AmazonEKS_EFS_CSI_ControllerRole @@ -101,2 +118 @@ Run the following commands to create an IAM role with `eksctl`. Replace `my-clus - --role-name $role_name \ - --role-only \ + --role-name $controller_role_name \ @@ -104,4 +120,5 @@ Run the following commands to create an IAM role with `eksctl`. Replace `my-clus - --approve - TRUST_POLICY=$(aws iam get-role --output json --role-name $role_name --query 'Role.AssumeRolePolicyDocument' | \ - sed -e 's/efs-csi-controller-sa/efs-csi-*/' -e 's/StringEquals/StringLike/') - aws iam update-assume-role-policy --role-name $role_name --policy-document "$TRUST_POLICY" + --approve \ + --region $region_code + + # Create the node role + export node_role_name=AmazonEKS_EFS_CSI_NodeRole @@ -112,2 +129,5 @@ Run the following commands to create an IAM role with `eksctl`. Replace `my-clus - --attach-role-arn arn:aws:iam::$account_id:role/$role_name \ - --approve + --role-name $node_role_name \ + --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \ + --attach-policy-arn arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils \ + --approve \ + --region $region_code @@ -157 +177 @@ Run the following to create an IAM role with AWS Management Console. - 1. For **Role name** , enter a unique name for your role, such as `AmazonEKS_EFS_CSI_DriverRole`. + 1. For **Role name** , enter a unique name for your role, such as `AmazonEKS_EFS_CSI_ControllerRole`. @@ -183 +203 @@ Run the following to create an IAM role with AWS Management Console. - 9. Repeat the above steps to create a second Pod Identity association with the same IAM role, but input `efs-csi-node-sa` for the **Kubernetes service account** field. + 9. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). @@ -185 +205 @@ Run the following to create an IAM role with AWS Management Console. - 10. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). + 10. Repeat the above steps to create a second role for the node service account. On the **Add permissions** page, attach `AmazonS3ReadOnlyAccess` and `AmazonElasticFileSystemsUtils` instead. Then create a Pod Identity association with `efs-csi-node-sa` for the **Kubernetes service account** field. @@ -199 +219 @@ Add the following line above the previous line. Replace `<region-code>` with the - "oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:sub": "system:serviceaccount:kube-system:efs-csi-*", + "oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:sub": "system:serviceaccount:kube-system:efs-csi-controller-sa", @@ -201 +221 @@ Add the following line above the previous line. Replace `<region-code>` with the - 4. Modify the `Condition` operator from `"StringEquals"` to `"StringLike"`. + 4. Choose **Update policy** to finish. @@ -203 +223 @@ Add the following line above the previous line. Replace `<region-code>` with the - 5. Choose **Update policy** to finish. + 5. Repeat the above steps to create a second role for the node service account. On the **Add permissions** page, attach `AmazonS3ReadOnlyAccess` and `AmazonElasticFileSystemsUtils` instead. In the trust policy, use `efs-csi-node-sa` for the `:sub` condition value. @@ -210 +230 @@ Add the following line above the previous line. Replace `<region-code>` with the -Run the following commands to create an IAM role with AWS CLI. +Run the following commands to create IAM roles with AWS CLI. @@ -235 +255 @@ Run the following commands to create an IAM role with AWS CLI. - 2. Create the role. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. + 2. Create the role. Replace `my-cluster` with your cluster name. @@ -238 +258 @@ Run the following commands to create an IAM role with AWS CLI. - export role_name=AmazonEKS_EFS_CSI_DriverRole + export controller_role_name=AmazonEKS_EFS_CSI_ControllerRole @@ -240 +260 @@ Run the following commands to create an IAM role with AWS CLI. - --role-name $role_name \ + --role-name $controller_role_name \ @@ -243 +263 @@ Run the following commands to create an IAM role with AWS CLI. - 2. Attach the required AWS managed policy to the role with the following command. + 2. Attach the required AWS managed policy to the controller role. @@ -247 +267,18 @@ Run the following commands to create an IAM role with AWS CLI. - --role-name $role_name + --role-name $controller_role_name + + 3. Create the node IAM role using the same trust policy. + + export node_role_name=AmazonEKS_EFS_CSI_NodeRole + aws iam create-role \ + --role-name $node_role_name \ + --assume-role-policy-document file://"aws-efs-csi-driver-trust-policy-pod-identity.json" + + 4. Attach the required AWS managed policies to the node role. + + aws iam attach-role-policy \ + --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \ + --role-name $node_role_name + + aws iam attach-role-policy \ + --policy-arn arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils \ + --role-name $node_role_name @@ -249 +286 @@ Run the following commands to create an IAM role with AWS CLI. - 3. Run the following commands to create the Pod Identity associations. Replace `<111122223333>` with your account ID. + 5. Run the following commands to create the Pod Identity associations. Replace `<111122223333>` with your account ID. @@ -251,2 +288,2 @@ Run the following commands to create an IAM role with AWS CLI. - aws eks create-pod-identity-association --cluster-name $cluster_name --role-arn {arn-aws}iam::<111122223333>:role/$role_name --namespace kube-system --service-account efs-csi-controller-sa - aws eks create-pod-identity-association --cluster-name $cluster_name --role-arn {arn-aws}iam::<111122223333>:role/$role_name --namespace kube-system --service-account efs-csi-node-sa + aws eks create-pod-identity-association --cluster-name $cluster_name --role-arn {arn-aws}iam::<111122223333>:role/$controller_role_name --namespace kube-system --service-account efs-csi-controller-sa + aws eks create-pod-identity-association --cluster-name $cluster_name --role-arn {arn-aws}iam::<111122223333>:role/$node_role_name --namespace kube-system --service-account efs-csi-node-sa @@ -254 +291 @@ Run the following commands to create an IAM role with AWS CLI. - 4. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). + 6. For more information on creating Pod Identity associations, see [Create a Pod Identity association (AWS Console)](./pod-id-association.html#pod-id-association-create). @@ -261 +298 @@ Run the following commands to create an IAM role with AWS CLI. - 1. View your cluster’s OIDC provider URL. Replace `my-cluster` with your cluster name. You can also replace `AmazonEKS_EFS_CSI_DriverRole` with a different name. + 1. View your cluster’s OIDC provider URL. Replace `my-cluster` with your cluster name. @@ -264 +300,0 @@ Run the following commands to create an IAM role with AWS CLI. - export role_name=AmazonEKS_EFS_CSI_DriverRole @@ -273 +309 @@ If the output from the command is `None`, review the **Prerequisites**. - 2. Create the IAM role that grants the `AssumeRoleWithWebIdentity` action. + 2. Create the IAM role for the controller service account. @@ -275 +311 @@ If the output from the command is `None`, review the **Prerequisites**. - 1. Copy the following contents to a file named `aws-efs-csi-driver-trust-policy.json`. Replace `<111122223333>` with your account ID. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` and `<region-code>` with the values returned in the previous step. + 1. Copy the following contents to a file named `controller-trust-policy.json`. Replace `<111122223333>` with your account ID. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` and `<region-code>` with the values returned in the previous step. @@ -283 +319 @@ If the output from the command is `None`, review the **Prerequisites**. - "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE" + "Federated": "arn:aws:iam::<111122223333>:oidc-provider/oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>" @@ -287,3 +323,3 @@ If the output from the command is `None`, review the **Prerequisites**. - "StringLike": { - "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:efs-csi-*", - "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com" + "StringEquals": { + "oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:aud": "sts.amazonaws.com", + "oidc.eks.<region-code>.amazonaws.com/id/<EXAMPLED539D4633E53DE1B71EXAMPLE>:sub": "system:serviceaccount:kube-system:efs-csi-controller-sa" @@ -297,0 +334 @@ If the output from the command is `None`, review the **Prerequisites**. + export controller_role_name=AmazonEKS_EFS_CSI_ControllerRole @@ -299,2 +336,2 @@ If the output from the command is `None`, review the **Prerequisites**. - --role-name $role_name \ - --assume-role-policy-document file://"aws-efs-csi-driver-trust-policy.json" + --role-name $controller_role_name \ + --assume-role-policy-document file://"controller-trust-policy.json" @@ -302 +339 @@ If the output from the command is `None`, review the **Prerequisites**. - 3. Attach the required AWS managed policy to the role with the following command. + 3. Attach the required AWS managed policy to the controller role. @@ -306 +343 @@ If the output from the command is `None`, review the **Prerequisites**. - --role-name $role_name + --role-name $controller_role_name @@ -307,0 +345 @@ If the output from the command is `None`, review the **Prerequisites**. + 4. Create the IAM role for the node service account. @@ -309,11 +347 @@ If the output from the command is `None`, review the **Prerequisites**. - - -### Enable direct S3 read access - -Enabling direct S3 read access allows the EFS CSI driver to read objects directly from S3, which can reduce costs and provide higher throughput for S3 file systems. Attach the following IAM policy to your EFS CSI driver’s IAM role. Replace `{YOUR_S3_BUCKET_NAME}` with your S3 bucket name. If your cluster is in the AWS GovCloud (US-East) or AWS GovCloud (US-West) AWS Regions, then replace `arn:aws:` with `arn:aws-us-gov:`. - -###### Note - -Before proceeding, confirm that your S3 bucket policy does not explicitly deny access from this IAM role. An explicit deny in the bucket policy will override the permissions granted here. Review your bucket policy in the S3 console or via `aws s3api get-bucket-policy --bucket {YOUR_S3_BUCKET_NAME}`. - - 1. Save the following contents to a file named `direct-s3-read-policy.json`. + 1. Copy the following contents to a file named `node-trust-policy.json`. Replace `<111122223333>` with your account ID. Replace `<EXAMPLED539D4633E53DE1B71EXAMPLE>` and `<region-code>` with the values returned in step 1. @@ -326,5 +354,2 @@ Before proceeding, confirm that your S3 bucket policy does not explicitly deny a - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "arn:aws:s3:::{YOUR_S3_BUCKET_NAME}/*"