AWS resilience-hub: Troubleshooting: EKS service account per namespace and role mapping
Summary
Adds troubleshooting guidance that for Amazon EKS pods the Kubernetes service account must exist in every targeted namespace and the execution role must be mapped to the cluster from the account that owns the cluster, with a link to the IAM permissions reference.
Security assessment
The added line documents IAM execution-role-to-cluster mapping and per-namespace Kubernetes service account requirements, which are IAM/access-control configuration details for fault injection rather than a fix for a specific vulnerability.
Evidence
+**Solution:** Follow the setup steps for your compute type in the [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html). For Amazon EKS pods, the service account must exist in every targeted namespace, and the execution role must be mapped to the cluster from the account that contains the cluster. Complete the **(Optional) Resilience testing** parts of the Amazon EKS permissions steps. For more information, see [Required IAM permissions and roles](./next-gen-iam-permissions.html).
Diff
diff --git a/resilience-hub/latest/userguide/next-gen-troubleshoot-test-dep-setup.md b/resilience-hub/latest/userguide/next-gen-troubleshoot-test-dep-setup.md index a06c8e5..ab244d2 100644 --- a//resilience-hub/latest/userguide/next-gen-troubleshoot-test-dep-setup.md +++ b//resilience-hub/latest/userguide/next-gen-troubleshoot-test-dep-setup.md @@ -13 +13 @@ -**Solution:** Follow the setup steps for your compute type in the [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html). +**Solution:** Follow the setup steps for your compute type in the [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html). For Amazon EKS pods, the service account must exist in every targeted namespace, and the execution role must be mapped to the cluster from the account that contains the cluster. Complete the **(Optional) Resilience testing** parts of the Amazon EKS permissions steps. For more information, see [Required IAM permissions and roles](./next-gen-iam-permissions.html).