AWS eks: Add ec2:DescribeSubnets to CNI IAM policy example

Service: eks · 2026-09-27 · Documentation medium

File: eks/latest/userguide/cni-iam-role.md · Type: iam

Summary

Adds the ec2:DescribeSubnets permission to the example IAM policy for the VPC CNI role.

Security assessment

The change grants an additional read-only EC2 permission in an example policy. It is an IAM policy modification with minor security relevance (broadens permissions) but is not tied to a vulnerability or security guidance.

Evidence

+                    "ec2:DescribeSubnets"

Diff

diff --git a/eks/latest/userguide/cni-iam-role.md b/eks/latest/userguide/cni-iam-role.md
index ba22deb0e..4f809ea60 100644
--- a//eks/latest/userguide/cni-iam-role.md
+++ b//eks/latest/userguide/cni-iam-role.md
@@ -216 +216,2 @@ If you created a cluster that uses the `IPv6` family and the cluster has version
-                    "ec2:DescribeInstanceTypes"
+                    "ec2:DescribeInstanceTypes",
+                    "ec2:DescribeSubnets"