AWS eks documentation change
Summary
Added documentation for two new AWS managed IAM policies (AmazonEBSCSIDriverPolicyV2 and AmazonEBSCSIDriverEKSClusterScopedPolicy) that provide more restrictive permission scoping for the EBS CSI driver, including tag-based and cluster-scoped isolation.
Security assessment
The change introduces new, more restrictive IAM policies as alternatives to the existing AmazonEBSCSIDriverPolicy. These policies enforce tag-based and cluster-scoped access controls to limit the EBS CSI driver's permissions, which improves security by implementing the principle of least privilege and preventing cross-cluster access. However, there is no evidence in the diff that this change addresses a specific security vulnerability or incident; it appears to be a proactive security enhancement.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index f20dfe7a0..e6c3c4592 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -7 +7 @@ -AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSDashboardConsoleReadOnlyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSConnectorServiceRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSMCPReadOnlyAccessAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonS3FilesCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies +AWS managed policy: AmazonEKS_CNI_PolicyAWS managed policy: AmazonEKSClusterPolicyAWS managed policy: AmazonEKSDashboardConsoleReadOnlyAWS managed policy: AmazonEKSFargatePodExecutionRolePolicyAWS managed policy: AmazonEKSConnectorServiceRolePolicyAWS managed policy: AmazonEKSForFargateServiceRolePolicyAWS managed policy: AmazonEKSComputePolicyAWS managed policy: AmazonEKSNetworkingPolicyAWS managed policy: AmazonEKSBlockStoragePolicyAWS managed policy: AmazonEKSLoadBalancingPolicyAWS managed policy: AmazonEKSMCPReadOnlyAccessAWS managed policy: AmazonEKSServicePolicyAWS managed policy: AmazonEKSServiceRolePolicyAWS managed policy: AmazonEKSVPCResourceControllerAWS managed policy: AmazonEKSWorkerNodePolicyAWS managed policy: AmazonEKSWorkerNodeMinimalPolicyAWS managed policy: AWSServiceRoleForAmazonEKSNodegroupAWS managed policy: AmazonEKSDashboardServiceRolePolicyAWS managed policy: AmazonEBSCSIDriverPolicyAWS managed policy: AmazonEBSCSIDriverPolicyV2AWS managed policy: AmazonEBSCSIDriverEKSClusterScopedPolicyAWS managed policy: AmazonEFSCSIDriverPolicyAWS managed policy: AmazonS3FilesCSIDriverPolicyAWS managed policy: AmazonEKSLocalOutpostClusterPolicyAWS managed policy: AmazonEKSLocalOutpostServiceRolePolicyAmazon EKS updates to AWS managed policies @@ -450,0 +451,4 @@ To view the latest version of the JSON policy document, see [AmazonEKSDashboardS +###### Important + +Two new AWS-managed IAM policies are available that provide more restrictive permission scoping: AmazonEBSCSIDriverPolicyV2 for tag-based scoping, or AmazonEBSCSIDriverEKSClusterScopedPolicy for cluster-scoped isolation. If interested in migrating, see [EBS CSI Driver policy migration](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2918). + @@ -454,0 +459,16 @@ To view the latest version of the JSON policy document, see [AmazonEBSCSIDriverS +## AWS managed policy: AmazonEBSCSIDriverPolicyV2 + +The `AmazonEBSCSIDriverPolicyV2` policy is a more restrictive alternative to `AmazonEBSCSIDriverPolicy`. It limits the Amazon EBS CSI driver to only managing EBS volumes and snapshots that are tagged with the key `ebs.csi.aws.com/cluster` set to `true`. Volumes provisioned by the in-tree Kubernetes volume plugin (CSI-migrated volumes) are also supported through the `kubernetes.io/created-for/pvc/name` resource tag. + +If migrating from `AmazonEBSCSIDriverPolicy`, please see [EBS CSI Driver policy migration](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2918). + +To view the latest version of the JSON policy document, see [AmazonEBSCSIDriverPolicyV2](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html#AmazonEBSCSIDriverPolicyV2-json) in the AWS Managed Policy Reference Guide. + +## AWS managed policy: AmazonEBSCSIDriverEKSClusterScopedPolicy + +The `AmazonEBSCSIDriverEKSClusterScopedPolicy` policy restricts the Amazon EBS CSI driver to only managing EBS volumes and snapshots that belong to a specific EKS cluster. It requires the resource tag `ebs.csi.aws.com/cluster-name` to match the `eks-cluster-name` tag on the IAM principal, preventing cross-cluster access when multiple clusters share the same AWS account. Attach and detach operations on instances are restricted to instances tagged with either the `eks:cluster-name` tag (set automatically by EKS on managed node groups) or the `ebs.csi.aws.com/cluster-name` tag (for manually tagged instances). + +If migrating from `AmazonEBSCSIDriverPolicy`, please see [EBS CSI Driver policy migration](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2918). + +To view the latest version of the JSON policy document, see [AmazonEBSCSIDriverEKSClusterScopedPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverEKSClusterScopedPolicy.html#AmazonEBSCSIDriverEKSClusterScopedPolicy-json) in the AWS Managed Policy Reference Guide. + @@ -519,0 +540 @@ Change | Description | Date +Introduced AmazonEBSCSIDriverPolicyV2 and AmazonEBSCSIDriverEKSClusterScopedPolicy. | Introduced `AmazonEBSCSIDriverPolicyV2` and `AmazonEBSCSIDriverEKSClusterScopedPolicy` as more restrictive alternatives to `AmazonEBSCSIDriverPolicy`. `AmazonEBSCSIDriverPolicyV2` scopes the EBS CSI driver to volumes and snapshots tagged with `ebs.csi.aws.com/cluster` set to `true`. `AmazonEBSCSIDriverEKSClusterScopedPolicy` scopes the driver to volumes and snapshots belonging to a specific EKS cluster using the `ebs.csi.aws.com/cluster-name` tag. | April 16, 2026