AWS eks documentation change
Summary
Added documentation for new EKS Auto Mode features including ALB Shield Advanced protection, LCU reservation, and listener rule priority management. Includes IAM policy update requirements.
Security assessment
The change adds documentation for ALB Shield Advanced protection (DDoS mitigation) and requires new IAM permissions including shield:CreateProtection. This documents security features but doesn't address a specific vulnerability.
Diff
diff --git a/eks/latest/userguide/auto-change.md b/eks/latest/userguide/auto-change.md index 8a7ff832d..e7914ef93 100644 --- a//eks/latest/userguide/auto-change.md +++ b//eks/latest/userguide/auto-change.md @@ -7 +7 @@ -June 9, 2026June 4, 2026June 3, 2026May 5, 2026April 10, 2026April 2, 2026February 2, 2026December 19, 2025November 19, 2025November 19, 2025October 23, 2025October 1, 2025September 30, 2025September 29, 2025September 10, 2025August 24, 2025August 15, 2025August 6, 2025June 30, 2025June 20, 2025June 13, 2025April 30, 2025April 18, 2025April 11, 2025April 4, 2025March 31, 2025March 21, 2025March 14, 2025 +June 30, 2026June 9, 2026June 4, 2026June 3, 2026May 5, 2026April 10, 2026April 2, 2026February 2, 2026December 19, 2025November 19, 2025November 19, 2025October 23, 2025October 1, 2025September 30, 2025September 29, 2025September 10, 2025August 24, 2025August 15, 2025August 6, 2025June 30, 2025June 20, 2025June 13, 2025April 30, 2025April 18, 2025April 11, 2025April 4, 2025March 31, 2025March 21, 2025March 14, 2025 @@ -21,0 +22,52 @@ To receive notifications of all source file changes to this specific documentati +## June 30, 2026 + +**Feature** : The EKS Auto Mode load balancer controller now supports features from AWS Load Balancer Controller v2.10, v2.11, and v2.12. + +From upstream v2.12.0: + + * Listener rule priority management — The controller can now explicitly set and reorder listener rule priorities, resolving ordering conflicts when multiple Ingress rules target the same listener + + + + +From upstream v2.11.0: + + * Load Balancer Capacity Unit (LCU) Reservation — You can now reserve capacity units on both Application Load Balancers (ALBs) and Network Load Balancers (NLBs), ensuring predictable performance for workloads with known traffic patterns + + + + +From upstream v2.10.0: + + * ALB Shield Advanced protection — ALB resources can now be protected with AWS Shield Advanced via the alb.ingress.kubernetes.io/shield-advanced-protection annotation + + * Bring your own custom TargetGroupBinding — You can now reference pre-existing target groups not created by the controller, enabling integration with externally managed infrastructure + + * UDP support for dual-stack NLB on IPv6 clusters — NLB Services on IPv6 clusters now support UDP protocol listeners + + * ALB HTTP and HTTPS listener attributes — Fine-grained control over listener-level attributes (for example, routing behavior, header modifications) via annotations + + + + +### Update on managed policies + +AWS has updated AmazonEKSServiceRolePolicy and AmazonEKSLoadBalancingPolicy to support these new features. + +### Action required for customers using custom IAM policies + +If you are supplying your own custom IAM policy for the EKS Auto Mode cluster role instead of using the AWS-managed AmazonEKSLoadBalancingPolicy, you must ensure your policy includes the permissions listed above. Failure to update your custom policy will result in access denied errors when using the new features. + +To verify parity, compare your custom policy against the [latest version of AmazonEKSLoadBalancingPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEKSLoadBalancingPolicy.html). + +Specifically, ensure your policy includes: + + * elasticloadbalancing:ModifyCapacityReservation, elasticloadbalancing:ModifyIpPools, elasticloadbalancing:ModifyListenerAttributes, and elasticloadbalancing:SetRulePriorities + + * ec2:DescribeIpamPools and ec2:DescribeRouteTables + + * shield:CreateProtection, shield:DeleteProtection, and shield:TagResource + + + +