AWS eks: Clarify IAM permission requirement for EKS Pod Identities
Summary
Rewrote permission requirement for EKS Pod Identities configuration to emphasize iam:PassRole.
Security assessment
Documents critical IAM permission requirement (iam:PassRole) for secure pod identity configuration.
Evidence
* The caller configuring EKS Pod Identities for service accounts must have the `iam:PassRole` permission for that role.
Diff
diff --git a/eks/latest/best-practices/identity-and-access-management.md b/eks/latest/best-practices/identity-and-access-management.md index 502db47f5..85695c967 100644 --- a//eks/latest/best-practices/identity-and-access-management.md +++ b//eks/latest/best-practices/identity-and-access-management.md @@ -3 +3 @@ -[](/pdfs/eks/latest/best-practices/eks-bpg.pdf#identity-and-access-management "Open PDF")[](https://github.com/aws/aws-eks-best-practices/tree/master/latest/bpg/security/iam.adoc "Edit this page on GitHub") +[](/pdfs/eks/latest/best-practices/eks-bpg.pdf#identity-and-access-management "Open PDF")[](https://github.com/aws/aws-eks-best-practices/tree/mainline/latest/bpg/security/iam.adoc "Edit this page on GitHub") @@ -542,3 +542 @@ You do not have to make any modifications to your application code to use EKS Po - * EKS Pod Identities can only directly assume an IAM role that belongs to the same AWS account as the EKS cluster. To access an IAM role in another AWS account, you must assume that role by [configuring a profile in your SDK configuration](https://docs.aws.amazon.com/sdkref/latest/guide/feature-assume-role-credentials.html), or in your [application’s code](https://docs.aws.amazon.com/IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.html). - - * When EKS Pod Identities are being configured for Service Accounts, the person or process configuring the Pod Identity Association must have the `iam:PassRole` entitlement for that role. + * The caller configuring EKS Pod Identities for service accounts must have the `iam:PassRole` permission for that role.