AWS eks: Typo fixes and permission updates in EKS IAM policy documentation
Summary
Corrected service role name typos, added dashes in permission descriptions, fixed changelog typos, and documented new ALB/DescribeIpamPools permissions.
Security assessment
The changes primarily involve documentation corrections (typos, formatting) and adding descriptions of new permissions for ALB rule management and IPAM pool visibility. These are operational updates without evidence of addressing vulnerabilities or introducing security features.
Evidence
+Updated permissions to AWS managed policy: AmazonEKSLoadBalancingPolicy. | Added `elasticloadbalancing:SetRulePriorities`, `ec2:DescribeIpamPools` permissions in `AmazonEKSLoadBalancingPolicy`. This allows Amazon EKS Auto Mode Controller to set priorities of the specified listener rules for ALB and describe IPAM pools, respectively. | June 15, 2026
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index 978c41127..6dd70725b 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -126 +126 @@ To view the latest version of the JSON policy document, see [AmazonEKSConnectorS -You can’t attach `AmazonEKSForFargateServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see `AWSServiceRoleforAmazonEKSForFargate`. +You can’t attach `AmazonEKSForFargateServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see `AWSServiceRoleForAmazonEKSForFargate`. @@ -275 +275 @@ This policy includes the following permissions that allow principals to complete - * **`eks` ** Allows principals to describe and list EKS clusters, node groups, add-ons, access entries, insights, and access the Kubernetes API for read-only operations. + * **`eks` ** – Allows principals to describe and list EKS clusters, node groups, add-ons, access entries, insights, and access the Kubernetes API for read-only operations. @@ -277 +277 @@ This policy includes the following permissions that allow principals to complete - * **`iam` ** Allows principals to retrieve information about IAM roles, policies, and their attachments to understand the permissions associated with EKS resources. + * **`iam` ** – Allows principals to retrieve information about IAM roles, policies, and their attachments to understand the permissions associated with EKS resources. @@ -279 +279 @@ This policy includes the following permissions that allow principals to complete - * **`ec2` ** Allows principals to describe VPCs, subnets, and route tables to understand the network configuration of EKS clusters. + * **`ec2` ** – Allows principals to describe VPCs, subnets, and route tables to understand the network configuration of EKS clusters. @@ -281 +281 @@ This policy includes the following permissions that allow principals to complete - * **`sts` ** Allows principals to retrieve caller identity information for authentication and authorization purposes. + * **`sts` ** – Allows principals to retrieve caller identity information for authentication and authorization purposes. @@ -283 +283 @@ This policy includes the following permissions that allow principals to complete - * **`logs` ** Allows principals to start queries and retrieve query results from CloudWatch Logs for troubleshooting and monitoring. + * **`logs` ** – Allows principals to start queries and retrieve query results from CloudWatch Logs for troubleshooting and monitoring. @@ -285 +285 @@ This policy includes the following permissions that allow principals to complete - * **`cloudwatch` ** Allows principals to retrieve metric data for monitoring cluster and workload performance. + * **`cloudwatch` ** – Allows principals to retrieve metric data for monitoring cluster and workload performance. @@ -287 +287 @@ This policy includes the following permissions that allow principals to complete - * **`eks-mcp` ** Allows principals to invoke MCP operations and call read-only tools within the Amazon EKS MCP Server. + * **`eks-mcp` ** – Allows principals to invoke MCP operations and call read-only tools within the Amazon EKS MCP Server. @@ -296 +296 @@ To view the latest version of the JSON policy document, see [AmazonEKSMCPReadOnl -You can attach `AmazonEKSServicePolicy` to your IAM entities. Clusters that were created before April 16, 2020, required you to create an IAM role and attach this policy to it. Clusters that were created on or after April 16, 2020, don’t require you to create a role and don’t require you to assign this policy. When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, the [AWSServiceRoleforAmazonEKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks) service-linked role is automatically created for you. The service-linked role has the managed policy: AmazonEKSServiceRolePolicy attached to it. +You can attach `AmazonEKSServicePolicy` to your IAM entities. Clusters that were created before April 16, 2020, required you to create an IAM role and attach this policy to it. Clusters that were created on or after April 16, 2020, don’t require you to create a role and don’t require you to assign this policy. When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, the [AWSServiceRoleForAmazonEKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks) service-linked role is automatically created for you. The service-linked role has the managed policy: AmazonEKSServiceRolePolicy attached to it. @@ -321 +321 @@ To view the latest version of the JSON policy document, see [AmazonEKSServicePol -You can’t attach `AmazonEKSServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see [Service-linked role permissions for Amazon EKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks). When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, the [AWSServiceRoleforAmazonEKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks) service-linked role is automatically created for you and this policy is attached to it. +You can’t attach `AmazonEKSServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon EKS to perform actions on your behalf. For more information, see [Service-linked role permissions for Amazon EKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks). When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, the [AWSServiceRoleForAmazonEKS](./using-service-linked-roles-eks.html#service-linked-role-permissions-eks) service-linked role is automatically created for you and this policy is attached to it. @@ -349 +349 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`pricing` ** **`shield` ** \- Access AWS pricing information and Shield protection status, enabling cost management and advanced security features for EKS resources. + * **`pricing` ** & **`shield` ** \- Access AWS pricing information and Shield protection status, enabling cost management and advanced security features for EKS resources. @@ -512 +512 @@ To view the latest version of the JSON policy document, see [AmazonEKSLocalOutpo -You can’t attach this policy to your IAM entities. When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, Amazon EKS automatically creates the [AWSServiceRoleforAmazonEKSLocalOutpost](./using-service-linked-roles-eks-outpost.html) service-linked role for you and attaches this policy to it. This policy allows the service-linked role to call AWS services on your behalf for local clusters. +You can’t attach this policy to your IAM entities. When you create a cluster using an IAM principal that has the `iam:CreateServiceLinkedRole` permission, Amazon EKS automatically creates the [AWSServiceRoleForAmazonEKSLocalOutpost](./using-service-linked-roles-eks-outpost.html) service-linked role for you and attaches this policy to it. This policy allows the service-linked role to call AWS services on your behalf for local clusters. @@ -543 +543 @@ Added permission to AmazonEKSServiceRolePolicy. | Added `AmazonEKSPodIdentityPo -Updated permissions to AWS managed policy: AmazonEKSLoadBalancingPolicy. | Added `elasticloadbalancing:SetRulePriorities`, `ec2:DescribeIpamPools` permissions in `AmazonEKSLoadBalancingPolicy`. This allows Amazon EKS Auto Mode Controller to set priorities of the specified listiner rules for ALB and describe ipam pools respectively | June 15, 2026 +Updated permissions to AWS managed policy: AmazonEKSLoadBalancingPolicy. | Added `elasticloadbalancing:SetRulePriorities`, `ec2:DescribeIpamPools` permissions in `AmazonEKSLoadBalancingPolicy`. This allows Amazon EKS Auto Mode Controller to set priorities of the specified listener rules for ALB and describe IPAM pools, respectively. | June 15, 2026 @@ -548 +548 @@ Added permissions to AmazonEBSCSIDriverPolicy. | Added new API action `ec2:Desc -Added permission to AWS managed policy: AmazonEKSLoadBalancingPolicy | Added `elasticloadbalancing:DescribeLoadBalancers` permission in `AmazonEKSLoadBalancingPolicy` to allow Amazon EKS Auto Mode Controller to describe LoadBalancer | April 27, 2026 +Added permission to AWS managed policy: AmazonEKSLoadBalancingPolicy | Added `elasticloadbalancing:DescribeLoadBalancers` permission in `AmazonEKSLoadBalancingPolicy` to allow Amazon EKS Auto Mode Controller to describe load balancers. | April 27, 2026