AWS eks: Document OIDC endpoint requirement for IRSA
Summary
Added explicit requirement for OIDC VPC endpoint when configuring IRSA in private clusters.
Security assessment
Clarifies secure network configuration requirements for identity management in private environments.
Evidence
+To set up IRSA, you also need to reach the cluster’s OIDC discovery/JWKS endpoint from inside the VPC.
Diff
diff --git a/eks/latest/userguide/private-clusters.md b/eks/latest/userguide/private-clusters.md index 698fb6337..b129a55c4 100644 --- a//eks/latest/userguide/private-clusters.md +++ b//eks/latest/userguide/private-clusters.md @@ -93,0 +94,2 @@ For additional arguments, see [Bootstrap script configuration parameters](./eks- +To set up IRSA, you also need to reach the cluster’s OIDC discovery/JWKS endpoint from inside the VPC. For example, you reach it when you create the cluster’s IAM OIDC identity provider or run your own token validators. If there is no outbound internet access, create and use a VPC endpoint for the cluster OIDC endpoint: `com.amazonaws.`region-code`.oidc-eks`. This is separate from the AWS STS VPC endpoint. STS fetches the cluster’s JWKS from within AWS, so the OIDC endpoint privatizes your VPC-originated OIDC traffic, while the STS endpoint privatizes the `AssumeRoleWithWebIdentity` call. For more information, see [Access the cluster OIDC endpoint using AWS PrivateLink](./vpc-interface-endpoints.html#oidc-vpc-interface-endpoints). + @@ -106,0 +109 @@ AWS Security Token Service (required when using IAM roles for service accounts) +Amazon EKS cluster OIDC endpoint (required to set up IAM roles for service accounts from inside the VPC) | com.amazonaws.`region-code`.oidc-eks