AWS eks documentation change
Summary
Updated authentication documentation for Amazon FSx CSI Driver add-on to clarify support for both EKS Pod Identity and IAM Roles for Service Accounts (IRSA), removing the requirement for Pod Identity agent.
Security assessment
This change documents authentication options for the FSx CSI Driver, which is security-related documentation. However, there is no evidence of a specific security issue being addressed - it appears to be clarifying existing authentication capabilities and providing flexibility. The change removes a previous restriction and adds IRSA as an alternative authentication method.
Diff
diff --git a/eks/latest/userguide/fsx-csi-create.md b/eks/latest/userguide/fsx-csi-create.md index 1f935fc2e..1dbeb528e 100644 --- a//eks/latest/userguide/fsx-csi-create.md +++ b//eks/latest/userguide/fsx-csi-create.md @@ -27 +27 @@ For detailed descriptions of the available parameters and complete examples that - * The Amazon FSx CSI Driver EKS add-on requires the EKS Pod Identity agent for authentication. Without this component, the add-on will fail with the error `Amazon EKS Pod Identity agent is not installed in the cluster`, preventing volume operations. Install the Pod Identity agent before or after deploying the FSx CSI Driver add-on. For more information, see [Set up the Amazon EKS Pod Identity Agent](./pod-id-agent-setup.html). + * The Amazon FSx CSI Driver EKS add-on supports authentication through either EKS Pod Identity or IAM Roles for Service Accounts (IRSA). To use EKS Pod Identity, install the Pod Identity agent before or after deploying the FSx CSI Driver add-on. For more information, see [Set up the Amazon EKS Pod Identity Agent](./pod-id-agent-setup.html). To use IRSA instead, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html).