AWS eks medium security documentation change
Summary
Updated documentation to reference the new AmazonEBSCSIDriverPolicyV2 policy instead of the older AmazonEBSCSIDriverPolicy, including updates to CLI commands, IAM console instructions, and adding migration guidance.
Security assessment
This change promotes the use of the more restrictive AmazonEBSCSIDriverPolicyV2 policy that implements tag-based access control for EBS volumes and snapshots. By updating all references and commands, AWS is encouraging users to adopt improved security practices with reduced permissions. The migration note references a GitHub issue (#2918) indicating this is a security enhancement.
Diff
diff --git a/eks/latest/userguide/ebs-csi.md b/eks/latest/userguide/ebs-csi.md index fb9f5f0d4..9361f2a85 100644 --- a//eks/latest/userguide/ebs-csi.md +++ b//eks/latest/userguide/ebs-csi.md @@ -78 +78 @@ The following procedure shows you how to create an IAM role and attach the AWS m -You can create a self-managed policy with scoped-down permissions. Review [`AmazonEBSCSIDriverPolicy`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) and create a custom IAM Policy with reduced permissions. +You can create a self-managed policy with further scoped-down permissions. Review [`AmazonEBSCSIDriverPolicyV2`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html) and create a custom IAM Policy with reduced permissions. If migrating from `AmazonEBSCSIDriverPolicy`, please see [EBS CSI Driver policy migration](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2918). @@ -94 +94 @@ The specific steps in this procedure are written for using the driver as an Amaz - --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ + --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicyV2 \ @@ -167 +167 @@ The specific steps in this procedure are written for using the driver as an Amaz - 1. In the **Filter policies** box, enter `AmazonEBSCSIDriverPolicy`. + 1. In the **Filter policies** box, enter `AmazonEBSCSIDriverPolicyV2`. @@ -169 +169 @@ The specific steps in this procedure are written for using the driver as an Amaz - 2. Select the check box to the left of the `AmazonEBSCSIDriverPolicy` returned in the search. + 2. Select the check box to the left of the `AmazonEBSCSIDriverPolicyV2` returned in the search. @@ -301 +301 @@ An example output is as follows. - --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ + --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicyV2 \