AWS eks documentation change
Summary
Updated AWS managed policy documentation to include new EC2 permissions (placement groups, on-demand capacity reservations), corrected a policy name link, updated a service role description, and added changelog entries for April 2026.
Security assessment
The changes document updates to IAM policies (AmazonEKSComputePolicy, AmazonEKSServiceRolePolicy) to include new permissions for EC2 placement groups and capacity reservations. This is routine documentation of expanded feature support and policy granularity. While IAM policies are inherently security-related, there is no evidence these changes address a specific security vulnerability or incident; they appear to be feature updates for EKS Auto Mode. The change to the AmazonEKSDashboardServiceRolePolicy description significantly reduces its stated permissions from 'create and manage' to 'view information', which could be a security hardening measure, but the diff provides no context about a specific incident.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index e6c3c4592..4e868d184 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -153 +153 @@ This policy includes the following permissions that allow Amazon EKS to complete - * `ec2:CreateFleet` and `ec2:RunInstances` \- Allows creating EC2 instances and using specific EC2 resources (images, security groups, subnets) for EKS cluster nodes. + * `ec2:CreateFleet` and `ec2:RunInstances` \- Allows creating EC2 instances and using specific EC2 resources (images, security groups, subnets, on-demand capacity reservations, placement groups) for EKS cluster nodes. @@ -327 +327 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`ec2` ** – Create and describe Elastic Network Interfaces and Amazon EC2 instances, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. Read information about On-Demand Capacity Reservations. Read VPC configuration including route tables and network ACLs to detect configuration issues as part of cluster insights. + * **`ec2` ** – Create and describe Elastic Network Interfaces and Amazon EC2 instances, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. Read information about On-Demand Capacity Reservations. Read information about Placement Groups. Read VPC configuration including route tables and network ACLs to detect configuration issues as part of cluster insights. @@ -409 +409 @@ This policy includes the following permissions that allow Amazon EKS to complete -To view the latest version of the JSON policy document, see [AmazonEKSWorkerNodePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEKSWorkerNodeMinimalPolicy.html#AmazonEKSWorkerNodeMinimalPolicy-json) in the AWS Managed Policy Reference Guide. +To view the latest version of the JSON policy document, see [AmazonEKSWorkerNodeMinimalPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEKSWorkerNodeMinimalPolicy.html#AmazonEKSWorkerNodeMinimalPolicy-json) in the AWS Managed Policy Reference Guide. @@ -436 +436 @@ You can’t attach `AmazonEKSDashboardServiceRolePolicy` to your IAM entities. T -This policy grants the `AWSServiceRoleForAmazonEKSDashboard` role permissions that allow it to create and manage Amazon EC2 node groups in your account. +This policy grants the `AWSServiceRoleForAmazonEKSDashboard` role permissions that allow it to view information about your AWS Organizations structure and accounts. @@ -539,0 +540 @@ Change | Description | Date +Added permission to AWS managed policy: AmazonEKSComputePolicy. | Updated resource permissions for the `ec2:RunInstances` and `ec2:CreateFleet` actions to include placement groups ` arn:aws:ec2:*:*:placement-group/*`. This allows Amazon EKS Auto Mode to launch instances into the EC2 Placement Groups in your account. | April 17, 2026 @@ -540,0 +542 @@ Introduced AmazonEBSCSIDriverPolicyV2 and AmazonEBSCSIDriverEKSClusterScopedPoli +Added permission to AmazonEKSServiceRolePolicy. | Added `ec2:DescribePlacementGroups` permission to allow Amazon EKS Auto Mode to launch instances into the EC2 Placement Groups in your account. | April 15, 2026