AWS eks documentation change

Service: eks · 2026-05-10 · Documentation low

File: eks/latest/best-practices/aiml-performance.md

Summary

Added new sections on reducing ECR image pull latency via VPC endpoints and optimizing network bandwidth for container image pulls.

Security assessment

The changes focus on performance optimization and cost reduction through network configuration. While VPC endpoints provide security benefits by keeping traffic private, the documentation change presents this primarily as a performance improvement without addressing specific security vulnerabilities.

Diff

diff --git a/eks/latest/best-practices/aiml-performance.md b/eks/latest/best-practices/aiml-performance.md
index 28b977eb6..1d85a8c37 100644
--- a//eks/latest/best-practices/aiml-performance.md
+++ b//eks/latest/best-practices/aiml-performance.md
@@ -76,0 +77,10 @@ Reducing the size of container images during startup is another way to make imag
+### Reduce Image Pull Latency
+
+For EKS clusters running in private subnets, configure VPC interface endpoints for Amazon ECR to keep image pull traffic on the AWS private network, reducing latency and eliminating NAT gateway data processing charges. See [Create the VPC endpoints for Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html) for setup instructions.
+
+Additionally, if your workloads rely on upstream container images from external registries, consider using [ECR pull through cache](https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html) to proxy and cache those images in your private ECR registry.
+
+### Optimize Network Bandwidth for Image Pulls
+
+When pulling large container images, the network bandwidth available to your EKS worker nodes directly impacts time-to-start for training and inference workloads. All current-generation Nitro-based instances use the Elastic Network Adapter (ENA), but available bandwidth varies significantly by instance size, and it’s critical to understand the difference between baseline and burst bandwidth (see [Amazon EC2 instance network bandwidth](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html)). To minimize time-to-ready for your workloads, select instance sizes with sufficient baseline network bandwidth relative to your image sizes and pull concurrency.
+