AWS eks documentation change
Summary
Expanded EBS CSI driver policy to include 'eks:eks-cluster-name' tag for volume operations, adding compatibility with Karpenter and EKS Auto Mode
Security assessment
Enhances IAM policy documentation by adding new allowed resource tag without indicating any vulnerability being fixed. Improves security posture through granular access control but lacks evidence of patching existing flaws.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index d108c653a..e0f655612 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -469 +469 @@ To view the latest version of the JSON policy document, see [AmazonEBSCSIDriverP -The `AmazonEBSCSIDriverEKSClusterScopedPolicy` policy restricts the Amazon EBS CSI driver to only managing EBS volumes and snapshots that belong to a specific EKS cluster. It requires the resource tag `ebs.csi.aws.com/cluster-name` to match the `eks-cluster-name` tag on the IAM principal, preventing cross-cluster access when multiple clusters share the same AWS account. Attach and detach operations on instances are restricted to instances tagged with either the `eks:cluster-name` tag (set automatically by EKS on managed node groups) or the `ebs.csi.aws.com/cluster-name` tag (for manually tagged instances). +The `AmazonEBSCSIDriverEKSClusterScopedPolicy` policy restricts the Amazon EBS CSI driver to only managing EBS volumes and snapshots that belong to a specific EKS cluster. It requires the resource tag `ebs.csi.aws.com/cluster-name` to match the `eks-cluster-name` tag on the IAM principal, preventing cross-cluster access when multiple clusters share the same AWS account. Attach and detach operations on instances are restricted to instances tagged with the `eks:cluster-name` tag (set automatically by EKS on managed node groups), the `eks:eks-cluster-name` tag (set by controllers that follow the EKS controller tagging standard, including open source Karpenter and Amazon EKS Auto Mode), or the `ebs.csi.aws.com/cluster-name` tag (for manually tagged instances). @@ -539,0 +540 @@ Change | Description | Date +Added permissions to AmazonEBSCSIDriverEKSClusterScopedPolicy. | Authorized `ec2:AttachVolume` and `ec2:DetachVolume` on instances tagged with the `eks:eks-cluster-name` tag, adding compatibility with controllers that follow the EKS controller tagging standard, including open source Karpenter and Amazon EKS Auto Mode. | May 28, 2026