AWS eks: EKS Auto Mode: scope IAM to limit subnet/SG tag selection
Summary
Adds a security best-practice note warning that tag selectors in a NodeClass match any tagged subnet/security group (including later-tagged resources), and recommends scoping the Auto Mode cluster IAM role so ec2:CreateNetworkInterface is restricted to intended subnets/security groups via a customer managed policy or explicit deny.
Security assessment
The added guidance documents a real security weakness: tag-based selection can silently include unintended subnets/security groups, potentially exposing nodes to the wrong network. It prescribes least-privilege IAM scoping of ec2:CreateNetworkInterface, which is a network/IAM hardening best practice rather than a fix for a specific disclosed vulnerability.
Evidence
* When you use tag selectors for subnets and security groups in a `NodeClass`, EKS Auto Mode automatically selects _any_ subnet or security group that has a matching tag, including resources that are tagged later. If you need to control exactly which subnets and security groups Auto Mode can use, don’t rely on tag selection alone. Instead, scope the [Amazon EKS Auto Mode cluster IAM role](./auto-cluster-iam-role.html) so that `ec2:CreateNetworkInterface` is limited to specific subnets and security groups. Rather than attaching the ` [AmazonEKSNetworkingPolicy](./security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEKSNetworkingPolicy) ` managed policy as-is, use a customer managed policy that restricts `ec2:CreateNetworkInterface` to the intended subnet and security group resources, or attach an additional policy that denies the action on all other resources. For more information, see [IAM JSON policy elements: NotResource](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html) in the IAM User Guide.
Diff
diff --git a/eks/latest/userguide/auto-security.md b/eks/latest/userguide/auto-security.md index e60973f18..42e9b16f1 100644 --- a//eks/latest/userguide/auto-security.md +++ b//eks/latest/userguide/auto-security.md @@ -152,0 +153,2 @@ The following section describes security best practices for Amazon EKS Auto Mode + * When you use tag selectors for subnets and security groups in a `NodeClass`, EKS Auto Mode automatically selects _any_ subnet or security group that has a matching tag, including resources that are tagged later. If you need to control exactly which subnets and security groups Auto Mode can use, don’t rely on tag selection alone. Instead, scope the [Amazon EKS Auto Mode cluster IAM role](./auto-cluster-iam-role.html) so that `ec2:CreateNetworkInterface` is limited to specific subnets and security groups. Rather than attaching the ` [AmazonEKSNetworkingPolicy](./security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEKSNetworkingPolicy) ` managed policy as-is, use a customer managed policy that restricts `ec2:CreateNetworkInterface` to the intended subnet and security group resources, or attach an additional policy that denies the action on all other resources. For more information, see [IAM JSON policy elements: NotResource](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html) in the IAM User Guide. +