AWS eks documentation change
Summary
Updated policy descriptions and added change history entries for IAM permission updates in April 2026
Security assessment
Updated EC2 and IAM permission descriptions in AmazonEKSServiceRolePolicy and added three change history entries for new permissions. These document IAM policy updates for Auto Mode Controller functionality. While IAM policies are security-related, there is no evidence of security vulnerability fixes - the changes appear to be routine permission additions for new features. The file itself is security documentation about IAM policies.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index 4e868d184..8f9450cf9 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -327 +327 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`ec2` ** – Create and describe Elastic Network Interfaces and Amazon EC2 instances, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. Read information about On-Demand Capacity Reservations. Read information about Placement Groups. Read VPC configuration including route tables and network ACLs to detect configuration issues as part of cluster insights. + * **`ec2` ** – Create and describe Elastic Network Interfaces, Amazon EC2 instances and their statuses, the cluster security group, and VPC that are required to create a cluster. For more information, see [View Amazon EKS security group requirements for clusters](./sec-group-reqs.html). Read information about security groups. Update tags on security groups. Read information about On-Demand Capacity Reservations. Read information about Placement Groups. Read VPC configuration including route tables and network ACLs to detect configuration issues as part of cluster insights. @@ -345 +345 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`iam` ** \- Manage EC2 instance profiles with the "eks" prefix, including creation, deletion, and role association, which is necessary for EKS node management. Allows describing any instance profile to enable users to define custom instance profiles for their worker nodes to use. + * **`iam` ** \- Manage EC2 instance profiles with the "eks" prefix, including listing, creation, deletion, and role association, which is necessary for EKS node management. Allows describing any instance profile to enable users to define custom instance profiles for their worker nodes to use. @@ -539,0 +540,3 @@ Change | Description | Date +Added permission to AWS managed policy: AmazonEKSServiceRolePolicy | Added `elasticloadbalancing:DescribeLoadBalancers` permission in `AmazonEKSLoadBalancingPolicy` to allow Amazon EKS Auto Mode Controller to describe LoadBalancer | April 27, 2026 +Added permission to AWS managed policy: AmazonEKSServiceRolePolicy | Added `elasticloadbalancing:DescribeCapacityReservation` permission in `AmazonEKSLoadBalancingPolicy` to allow Amazon EKS Auto Mode Controller to describe LoadBalancer capacity units | April 20, 2026 +Added permission to AWS managed policy: AmazonEKSServiceRolePolicy | Added `ec2:DescribeInstanceStatus` and `iam:ListInstanceProfiles` permissions in `AmazonEKSServiceRolePolicy`. These permissions allow Amazon EKS Auto Mode to discover EC2 health events for managed instances and cleanup managed instance profiles | April 20, 2026