AWS eks medium security documentation change
Summary
Removed documentation about --ack-service-controllers flag optionality and security recommendation to enable only necessary controllers.
Security assessment
Deletion of security best practice advice ('For better performance and security, consider enabling only the controllers you need') reduces guidance for secure configurations. This could lead to over-provisioned permissions if users enable unnecessary controllers.
Diff
diff --git a/eks/latest/userguide/ack-create-eksctl.md b/eks/latest/userguide/ack-create-eksctl.md index 7d795a2cf..dd4bab599 100644 --- a//eks/latest/userguide/ack-create-eksctl.md +++ b//eks/latest/userguide/ack-create-eksctl.md @@ -72,6 +72 @@ Create the ACK capability using eksctl. Replace `region-code` with the AWS Regio - --role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/ACKCapabilityRole \ - --ack-service-controllers s3 - -###### Note - -The `--ack-service-controllers` flag is optional. If omitted, ACK enables all available controllers. For better performance and security, consider enabling only the controllers you need. You can specify multiple controllers: `--ack-service-controllers s3,rds,dynamodb` + --role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/ACKCapabilityRole