AWS eks: Add PrivateLink note for OIDC key validation

Service: eks · 2026-07-29 · Documentation medium

File: eks/latest/userguide/irsa-fetch-keys.md · Type: network

Summary

Added guidance for private OIDC discovery/JWKS validation using AWS PrivateLink in air-gapped VPCs.

Security assessment

Provides secure alternative to public internet access for key validation, reducing attack surface.

Evidence

+If your validator runs in a VPC without outbound internet access, you can fetch the discovery document and JWKS privately by creating an AWS PrivateLink interface endpoint for the cluster OIDC endpoint (`com.amazonaws.region-code.oidc-eks`).

Diff

diff --git a/eks/latest/userguide/irsa-fetch-keys.md b/eks/latest/userguide/irsa-fetch-keys.md
index 008c52f06..3f1db3fab 100644
--- a//eks/latest/userguide/irsa-fetch-keys.md
+++ b//eks/latest/userguide/irsa-fetch-keys.md
@@ -18,0 +19,4 @@ To validate a `ProjectedServiceAccountToken`, you need to fetch the OIDC public
+###### Note
+
+If your validator runs in a VPC without outbound internet access, you can fetch the discovery document and JWKS privately by creating an AWS PrivateLink interface endpoint for the cluster OIDC endpoint (`com.amazonaws.region-code.oidc-eks`). For more information, see [Access the cluster OIDC endpoint using AWS PrivateLink](./vpc-interface-endpoints.html#oidc-vpc-interface-endpoints).
+