AWS eks documentation change

Service: eks · 2026-05-22 · Documentation medium

File: eks/latest/userguide/lis-csi.md

Summary

Added documentation for I/O throttling feature in Amazon EC2 Instance Store CSI driver

Security assessment

The change introduces documentation for I/O throttling, a security feature that prevents resource starvation attacks by ensuring fair bandwidth sharing across workloads. While this improves security posture by mitigating noisy neighbor risks, there's no evidence it addresses a specific existing vulnerability.

Diff

diff --git a/eks/latest/userguide/lis-csi.md b/eks/latest/userguide/lis-csi.md
index 98015ad15..5b919682d 100644
--- a//eks/latest/userguide/lis-csi.md
+++ b//eks/latest/userguide/lis-csi.md
@@ -7 +7 @@
-ConsiderationsPrerequisitesInstalling the Amazon EC2 Instance Store CSI driverDeploying a sample application
+ConsiderationsPrerequisitesInstalling the Amazon EC2 Instance Store CSI driverDeploying a sample applicationI/O throttling
@@ -36,0 +37,2 @@ The Amazon EC2 Instance Store CSI driver will erase all data on ephemeral disks
+  * I/O throttling is enabled by default for all volumes to ensure fair bandwidth sharing across workloads. For more information, see I/O throttling.
+
@@ -60,0 +63,72 @@ After installing the driver, you can deploy sample applications to verify that i
+## I/O throttling
+
+The Amazon EC2 Instance Store CSI driver includes built-in I/O throttling to ensure fair bandwidth sharing across workloads on the same NVMe controller. Throttling is enabled by default for all volumes, preventing any single workload from consuming disproportionate I/O bandwidth at the expense of other workloads on the same node.
+
+### Configuring throttling
+
+You can configure throttling at two levels:
+
+  * **StorageClass parameter** – Set the `throttling` parameter to `"true"` (default) or `"false"` in your StorageClass definition.
+
+  * **PVC annotation** – Set the `lis.csi.aws.com/throttling` annotation to `"true"` or `"false"` on individual PersistentVolumeClaims. This overrides the StorageClass setting when present.
+
+
+
+
+The following table shows how the StorageClass parameter and PVC annotation interact:
+
+PVC Annotation | StorageClass Parameter | Result  
+---|---|---  
+Not set |  Not set |  Throttling enabled (default)  
+Not set |  `"false"` |  Throttling disabled  
+`"false"` |  `"true"` or not set |  Throttling disabled  
+`"true"` |  `"false"` |  Throttling enabled  
+  
+### Creating an unthrottled StorageClass
+
+To disable throttling for all volumes in a StorageClass:
+    
+    
+    apiVersion: storage.k8s.io/v1
+    kind: StorageClass
+    metadata:
+      name: ec2-instance-store-unthrottled
+    provisioner: lis.csi.aws.com
+    parameters:
+      throttling: "false"
+    volumeBindingMode: WaitForFirstConsumer
+
+### Disabling throttling for a single PVC
+
+To disable throttling on an individual PVC while using a throttled StorageClass:
+    
+    
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: high-perf-pvc
+      annotations:
+        lis.csi.aws.com/throttling: "false"
+    spec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: ec2-instance-store-sc
+      resources:
+        requests:
+          storage: 100Gi
+
+### Throttling considerations
+
+  * Throttling is enabled by default to provide predictable performance for all workloads sharing an NVMe controller.
+
+  * Disabling throttling on a volume allows it to consume more I/O bandwidth, which may impact the performance of other throttled volumes on the same controller.
+
+  * Consider isolating unthrottled workloads on dedicated nodes.
+
+  * For RAID-0 volumes that span multiple controllers, throttling is applied to all member partitions.
+
+  * Throttle state persists across node reboots.
+
+
+
+