AWS eks: Include OIDC endpoint in VPC requirements
Summary
Added OIDC endpoint to list of required VPC endpoints for IRSA in private subnets.
Security assessment
Expands security documentation by including OIDC endpoint as critical infrastructure for secure service account operations.
Evidence
+ If you use IAM roles for service accounts (IRSA), you can also reach the cluster OIDC discovery/JWKS endpoint privately with the `com.amazonaws.region-code.oidc-eks` endpoint.
Diff
diff --git a/eks/latest/userguide/network-reqs.md b/eks/latest/userguide/network-reqs.md index 3111b0c41..92b38553f 100644 --- a//eks/latest/userguide/network-reqs.md +++ b//eks/latest/userguide/network-reqs.md @@ -148 +148 @@ You can deploy nodes and Kubernetes resources to the same subnets that you speci - * If the subnet that you deploy a node to is a private subnet and its route table doesn’t include a route to a network address translation [(NAT) device](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat.html) (`IPv4`) or an [egress-only gateway](https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html) (`IPv6`), add VPC endpoints using AWS PrivateLink to your VPC. VPC endpoints are needed for all the AWS services that your nodes and Pods need to communicate with. Examples include Amazon ECR, Elastic Load Balancing, Amazon CloudWatch, AWS Security Token Service, and Amazon Simple Storage Service (Amazon S3). The endpoint must include the subnet that the nodes are in. Not all AWS services support VPC endpoints. For more information, see [What is AWS PrivateLink?](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) and [AWS services that integrate with AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html). For a list of more Amazon EKS requirements, see [Deploy private clusters with limited internet access](./private-clusters.html). + * If the subnet that you deploy a node to is a private subnet and its route table doesn’t include a route to a network address translation [(NAT) device](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat.html) (`IPv4`) or an [egress-only gateway](https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html) (`IPv6`), add VPC endpoints using AWS PrivateLink to your VPC. VPC endpoints are needed for all the AWS services that your nodes and Pods need to communicate with. Examples include Amazon ECR, Elastic Load Balancing, Amazon CloudWatch, AWS Security Token Service, and Amazon Simple Storage Service (Amazon S3). If you use IAM roles for service accounts (IRSA), you can also reach the cluster OIDC discovery/JWKS endpoint privately with the `com.amazonaws.region-code.oidc-eks` endpoint. For more information, see [Access the cluster OIDC endpoint using AWS PrivateLink](./vpc-interface-endpoints.html#oidc-vpc-interface-endpoints). The endpoint must include the subnet that the nodes are in. Not all AWS services support VPC endpoints. For more information, see [What is AWS PrivateLink?](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) and [AWS services that integrate with AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html). For a list of more Amazon EKS requirements, see [Deploy private clusters with limited internet access](./private-clusters.html).