AWS eks documentation change

Service: eks · 2026-07-01 · Documentation low

File: eks/latest/userguide/security-iam-id-based-policy-examples.md

Summary

Added documentation for eks:CancelUpdate action with IAM policy examples

Security assessment

Adds security documentation for new IAM action (CancelUpdate) with resource/tag-based examples. Enhances access control guidance but no evidence of security vulnerability being addressed.

Diff

diff --git a/eks/latest/userguide/security-iam-id-based-policy-examples.md b/eks/latest/userguide/security-iam-id-based-policy-examples.md
index 6cd8effd2..b8fb07617 100644
--- a//eks/latest/userguide/security-iam-id-based-policy-examples.md
+++ b//eks/latest/userguide/security-iam-id-based-policy-examples.md
@@ -7 +7 @@
-Policy best practicesUsing the Amazon EKS consoleAllow IAM users to view their own permissionsCreate a Kubernetes cluster on the AWS CloudCreate a local Kubernetes cluster on an OutpostUpdate a Kubernetes clusterList or describe all clusters
+Policy best practicesUsing the Amazon EKS consoleAllow IAM users to view their own permissionsCreate a Kubernetes cluster on the AWS CloudCreate a local Kubernetes cluster on an OutpostUpdate a Kubernetes clusterList or describe all clustersCancel a cluster update (rollback)
@@ -38,0 +39,2 @@ For more information about working with the ConfigMap, see [Grant IAM users and
+  * Cancel a cluster update (rollback)
+
@@ -250,0 +253,35 @@ This example policy includes the minimum permissions required to list and descri
+## Cancel a cluster update (rollback)
+
+To allow users to cancel in-progress rollback operations, grant the `eks:CancelUpdate` action. You can scope this using resource ARN or tag-based conditions.
+
+**Resource ARN-based:**
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [{
+        "Effect": "Allow",
+        "Action": "eks:CancelUpdate",
+        "Resource": "arn:aws:eks:us-west-2:111122223333:cluster/my-cluster"
+      }]
+    }
+
+**Tag-based:**
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [{
+        "Effect": "Allow",
+        "Action": "eks:CancelUpdate",
+        "Resource": "*",
+        "Condition": {
+          "StringEquals": {
+            "aws:ResourceTag/environment": "development"
+          }
+        }
+      }]
+    }
+
+For more information about the full cluster rollback process, see [Rollback cluster to previous Kubernetes version](./rollback-cluster.html).
+