AWS eks medium security documentation change
Summary
Added documentation for new AWS managed policies AmazonEBSCSIDriverPolicyV2 and AmazonEBSCSIDriverEKSClusterScopedPolicy as more restrictive alternatives to AmazonEBSCSIDriverPolicy, implementing tag-based resource scoping.
Security assessment
This change introduces more restrictive IAM policies that scope the EBS CSI driver's permissions using resource tags (ebs.csi.aws.com/cluster and ebs.csi.aws.com/cluster-name). This is a security improvement implementing the principle of least privilege by reducing the attack surface and preventing unauthorized access to EBS volumes and snapshots. The explicit mention of 'more restrictive alternatives' indicates a security enhancement.
Diff
diff --git a/eks/latest/userguide/doc-history.md b/eks/latest/userguide/doc-history.md index ded44d270..11e6e78fe 100644 --- a//eks/latest/userguide/doc-history.md +++ b//eks/latest/userguide/doc-history.md @@ -19,0 +20 @@ Change| Description| Date +[New AWS managed policy](https://docs.aws.amazon.com/eks/latest/userguide/security-iam-awsmanpol.html)| Introduced `AmazonEBSCSIDriverPolicyV2` and `AmazonEBSCSIDriverEKSClusterScopedPolicy` as more restrictive alternatives to `AmazonEBSCSIDriverPolicy`. `AmazonEBSCSIDriverPolicyV2` scopes the EBS CSI driver to volumes and snapshots tagged with `ebs.csi.aws.com/cluster` set to `true`. `AmazonEBSCSIDriverEKSClusterScopedPolicy` scopes the driver to volumes and snapshots belonging to a specific EKS cluster using the `ebs.csi.aws.com/cluster-name` tag.| April 16, 2026