AWS eks documentation change
Summary
Updated EBS CSI Driver add-on documentation to reference new, more restrictive IAM policies (V2 and cluster-scoped) and updated example command to use AmazonEBSCSIDriverPolicyV2. Also updated FSx CSI Driver add-on documentation to clarify support for both EKS Pod Identity and IRSA authentication methods.
Security assessment
The change updates documentation to promote the use of more restrictive IAM policies (tag-based and cluster-scoped) for the EBS CSI driver, which enhances security by limiting permissions. It also clarifies authentication options for the FSx CSI Driver, which helps users configure secure authentication. However, there is no evidence of a specific security vulnerability being addressed; these are documentation updates for new security features and best practices.
Diff
diff --git a/eks/latest/userguide/workloads-add-ons-available-eks.md b/eks/latest/userguide/workloads-add-ons-available-eks.md index abc0ed8be..9290854d6 100644 --- a//eks/latest/userguide/workloads-add-ons-available-eks.md +++ b//eks/latest/userguide/workloads-add-ons-available-eks.md @@ -128 +128,3 @@ The Amazon EKS add-on name is `aws-ebs-csi-driver`. -This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. For more information, see [IAM roles for service accounts](./iam-roles-for-service-accounts.html). The permissions in the [AmazonEBSCSIDriverPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) AWS managed policy are required. You can create an IAM role and attach the managed policy to it with the following command. Replace `my-cluster` with the name of your cluster and `AmazonEKS_EBS_CSI_DriverRole` with the name for your role. This command requires that you have [eksctl](https://eksctl.io) installed on your device. If you need to use a different tool or you need to use a custom [KMS key](https://aws.amazon.com/kms/) for encryption, see [Step 1: Create an IAM role](./ebs-csi.html#csi-iam-role). +This add-on utilizes the IAM roles for service accounts capability of Amazon EKS. For more information, see [IAM roles for service accounts](./iam-roles-for-service-accounts.html). This add-on requires one of the following AWS managed policies: [AmazonEBSCSIDriverPolicyV2](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html) for tag-based scoping, [AmazonEBSCSIDriverEKSClusterScopedPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverEKSClusterScopedPolicy.html) for cluster-scoped isolation, or [AmazonEBSCSIDriverPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) if you don’t want any tag-based restrictions. You can create an IAM role and attach the managed policy to it with the following command. Replace `my-cluster` with the name of your cluster and `AmazonEKS_EBS_CSI_DriverRole` with the name for your role. This command requires that you have [eksctl](https://eksctl.io) installed on your device. If you need to use a different tool or you need to use a custom [KMS key](https://aws.amazon.com/kms/) for encryption, see [Step 1: Create an IAM role](./ebs-csi.html#csi-iam-role). + +If migrating from `AmazonEBSCSIDriverPolicy`, please see [EBS CSI Driver policy migration](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2918). @@ -137 +139 @@ This add-on utilizes the IAM roles for service accounts capability of Amazon EKS - --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ + --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicyV2 \ @@ -202 +204 @@ The Amazon EKS add-on name is `aws-fsx-csi-driver`. - * The Amazon FSx CSI Driver EKS add-on requires the EKS Pod Identity agent for authentication. Without this component, the add-on will fail with the error `Amazon EKS Pod Identity agent is not installed in the cluster`, preventing volume operations. Install the Pod Identity agent before or after deploying the FSx CSI Driver add-on. For more information, see [Set up the Amazon EKS Pod Identity Agent](./pod-id-agent-setup.html). + * The Amazon FSx CSI Driver EKS add-on supports authentication through either EKS Pod Identity or IAM Roles for Service Accounts (IRSA). To use EKS Pod Identity, install the Pod Identity agent before or after deploying the FSx CSI Driver add-on. For more information, see [Set up the Amazon EKS Pod Identity Agent](./pod-id-agent-setup.html). To use IRSA instead, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html).