AWS eks documentation change

Service: eks · 2026-04-22 · Documentation medium

File: eks/latest/userguide/creating-access-entries.md

Summary

Fixed enum value case (EC2_Windows->EC2_WINDOWS), clarified behavior for non-existent Kubernetes groups in access entries, and corrected a parameter name (--user->--username) in an example command.

Security assessment

These changes improve documentation accuracy for access entries, a security feature for cluster authentication. The clarification about non-existent groups explicitly states that IAM principals won't have permissions without matching Kubernetes RBAC, which is important for understanding security configuration. However, there is no evidence of a specific security vulnerability being addressed.

Diff

diff --git a/eks/latest/userguide/creating-access-entries.md b/eks/latest/userguide/creating-access-entries.md
index 2becf92e3..e885126d7 100644
--- a//eks/latest/userguide/creating-access-entries.md
+++ b//eks/latest/userguide/creating-access-entries.md
@@ -59 +59 @@ Role |  `STANDARD` |  The STS ARN of the role when it’s assumed. Amazon EKS ap
-Role |  `EC2_LINUX` or `EC2_Windows` |  `system:node:{{EC2PrivateDNSName}}`  
+Role |  `EC2_LINUX` or `EC2_WINDOWS` |  `system:node:{{EC2PrivateDNSName}}`  
@@ -69 +69 @@ You can change the username after the access entry is created.
-Amazon EKS doesn’t confirm that any Kubernetes RBAC objects that exist on your cluster include any of the group names that you specify. For example, if you create an access entry for group that currently doesn’t exist, EKS will create the group instead of returning an error.
+Amazon EKS doesn’t confirm that any Kubernetes RBAC objects that exist on your cluster include any of the group names that you specify. For example, if you create an access entry for group that currently doesn’t exist, Amazon EKS will accept the configuration without returning an error, but the IAM principal won’t have any permissions until matching Kubernetes RBAC resources are created.
@@ -139 +139 @@ You can’t use the `--kubernetes-groups` option when you specify a type other t
-                aws eks create-access-entry --cluster-name my-cluster --principal-arn arn:aws:iam::111122223333:role/my-role --type STANDARD --user Viewers --kubernetes-groups Viewers
+                aws eks create-access-entry --cluster-name my-cluster --principal-arn arn:aws:iam::111122223333:role/my-role --type STANDARD --username Viewers --kubernetes-groups Viewers