AWS eks high security documentation change
Summary
Added documentation about template variables for AWS IAM Authenticator, including security warnings about session name risks in role mappings.
Security assessment
The change explicitly warns about impersonation risks and privilege escalation vulnerabilities when using {{SessionName}} variables in role mappings. It addresses CVE-like risks where attackers could control group memberships or usernames through RoleSessionName manipulation.
Diff
diff --git a/eks/latest/userguide/auth-configmap.md b/eks/latest/userguide/auth-configmap.md index ee7d93eda..98f6b9109 100644 --- a//eks/latest/userguide/auth-configmap.md +++ b//eks/latest/userguide/auth-configmap.md @@ -232 +232 @@ If you receive an error stating " `Error from server (NotFound): configmaps "aws - 3. For example, the following YAML block contains: +=== Template variables for `username` and `groups` @@ -234 +233,0 @@ If you receive an error stating " `Error from server (NotFound): configmaps "aws - * A `mapRoles` section that maps the IAM node instance to Kubernetes groups so that nodes can register themselves with the cluster and the `my-console-viewer-role` IAM role that is mapped to a Kubernetes group that can view all Kubernetes resources for all clusters. For a list of the IAM and Kubernetes group permissions required for the `my-console-viewer-role` IAM role, see [Required permissions](./view-kubernetes-resources.html#view-kubernetes-resources-permissions). @@ -236 +234,0 @@ If you receive an error stating " `Error from server (NotFound): configmaps "aws - * A `mapUsers` section that maps the `admin` IAM user from the default AWS account to the `system:masters` Kubernetes group and the `my-user` user from a different AWS account that is mapped to a Kubernetes group that can view Kubernetes resources for a specific namespace. For a list of the IAM and Kubernetes group permissions required for the `my-user` IAM user, see [Required permissions](./view-kubernetes-resources.html#view-kubernetes-resources-permissions). @@ -238 +236,38 @@ If you receive an error stating " `Error from server (NotFound): configmaps "aws -Add or remove lines as necessary and replace all example values with your own values. + +The `username` and `groups` fields in both `mapRoles` and `mapUsers` entries support template variables that the AWS IAM Authenticator replaces at authentication time. The following template variables are available: + +`{{AccountID}}` + + +The 12-digit AWS account ID of the authenticated IAM principal. + +`{{SessionName}}` + + +The STS role session name, with `@` characters replaced by `-`. For EC2 instance roles, this is the instance ID. For federated roles, this is the federated identity. For roles assumed with `sts:AssumeRole`, this is the value of the `RoleSessionName` parameter set by the caller. + +`{{SessionNameRaw}}` + + +The raw STS role session name without any character replacement. + +`{{AccessKeyID}}` + + +The AWS access key ID used to authenticate the request. + +`{{EC2PrivateDNSName}}` + + +The private DNS name of the EC2 instance. This variable requires the session name to be a valid EC2 instance ID and makes an `ec2:DescribeInstances` API call. + +###### Important + +The `{{SessionName}}` and `{{SessionNameRaw}}` values are user-controlled when a role is assumed with `sts:AssumeRole`. The caller sets the `RoleSessionName` parameter to a nearly arbitrary string. If you use these variables in the `username` field, a caller who can assume the mapped role can impersonate any Kubernetes username that doesn’t match a reserved prefix (such as `system:`, `eks:`, `aws:`, `amazon:`, or `iam:`). If you use these variables in the `groups` field, a caller can choose their own Kubernetes group membership by crafting the session name. Only use `{{SessionName}}` or `{{SessionNameRaw}}` in `username` or `groups` if you trust all principals that can assume the role. + +\+ . For example, the following YAML block contains: **A`mapRoles` section that maps the IAM node instance to Kubernetes groups so that nodes can register themselves with the cluster and the `my-console-viewer-role` IAM role that is mapped to a Kubernetes group that can view all Kubernetes resources for all clusters. For a list of the IAM and Kubernetes group permissions required for the `my-console-viewer-role` IAM role, see [Required permissions](./view-kubernetes-resources.html#view-kubernetes-resources-permissions). ** A `mapUsers` section that maps the `admin` IAM user from the default AWS account to the `system:masters` Kubernetes group and the `my-user` user from a different AWS account that is mapped to a Kubernetes group that can view Kubernetes resources for a specific namespace. For a list of the IAM and Kubernetes group permissions required for the `my-user` IAM user, see [Required permissions](./view-kubernetes-resources.html#view-kubernetes-resources-permissions). + +\+ Add or remove lines as necessary and replace all example values with your own values. + ++ + @@ -266 +301 @@ Add or remove lines as necessary and replace all example values with your own va - 4. Save the file and exit your text editor. + 1. Save the file and exit your text editor.