AWS eks: Clarify OIDC endpoint access in private VPC
Summary
Updated guidance for accessing OIDC endpoint in VPCs without internet access, recommending PrivateLink setup instead of split-horizon DNS.
Security assessment
The change documents secure network access patterns for OIDC endpoints in restricted environments, reducing exposure to internet-based attacks.
Evidence
+To reach the cluster OIDC endpoint privately from your VPC, create a VPC interface endpoint for it (`com.amazonaws.`region-code`.oidc-eks`) with private DNS enabled.
Diff
diff --git a/eks/latest/userguide/iam-roles-for-service-accounts.md b/eks/latest/userguide/iam-roles-for-service-accounts.md index 44c1a5a82..8d1c77377 100644 --- a//eks/latest/userguide/iam-roles-for-service-accounts.md +++ b//eks/latest/userguide/iam-roles-for-service-accounts.md @@ -49 +49 @@ Enable IAM roles for service accounts by completing the following procedures: -If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be accessed from inside that VPC. Consequently, your operations such as creating an OIDC provider with `eksctl` in the VPC will not work and will result in a timeout when attempting to request `https://oidc.eks.`region`.amazonaws.com`. An example error message follows: +If your cluster’s VPC has no outbound internet access and you haven’t set up private access to the cluster OIDC endpoint, operations that reach that endpoint from inside the VPC, such as creating an OIDC provider with `eksctl`, can’t resolve the OIDC issuer hostname. An example error message follows: @@ -53 +53,3 @@ If you enabled the EKS VPC endpoint, the EKS OIDC service endpoint couldn’t be -To complete this step, you can run the command outside the VPC, for example in AWS CloudShell or on a computer connected to the internet. Alternatively, you can create a split-horizon conditional resolver in the VPC, such as Route 53 Resolver to use a different resolver for the OIDC Issuer URL and not use the VPC DNS for it. For an example of conditional forwarding in CoreDNS, see the [Amazon EKS feature request](https://github.com/aws/containers-roadmap/issues/2038) on GitHub. +To reach the cluster OIDC endpoint privately from your VPC, create a VPC interface endpoint for it (`com.amazonaws.`region-code`.oidc-eks`) with private DNS enabled. For more information, see [Access Amazon EKS using AWS PrivateLink](./vpc-interface-endpoints.html). + +Alternatively, you can run the command outside the VPC (for example, in AWS CloudShell) or create a split-horizon conditional resolver. For an example, see the [Amazon EKS feature request](https://github.com/aws/containers-roadmap/issues/2038) on GitHub.