AWS eks: EKS doc history: AmazonEKSServiceRolePolicy permission additions
Summary
Adds a document-history entry recording that eks:CreateCertificateAuthority, eks:ActivateCertificateAuthority, eks:DeleteCertificateAuthority, and ec2:RebootInstances were added to AmazonEKSServiceRolePolicy for CA rotation and EKS Auto Mode instance reboots.
Security assessment
The entry documents expansion of an AWS service-linked role's IAM permissions, including certificate authority lifecycle management and EC2 instance reboot. This is IAM/privilege-relevant transparency documentation rather than a fix for a specific vulnerability, so it is security-adjacent (medium) but not tied to an incident or CVE.
Evidence
+[AWS managed policy updates](https://docs.aws.amazon.com/eks/latest/userguide/security-iam-awsmanpol.html)| Added the `eks:CreateCertificateAuthority`, `eks:ActivateCertificateAuthority`, `eks:DeleteCertificateAuthority`, and `ec2:RebootInstances` permissions to `AmazonEKSServiceRolePolicy`. These permissions allow Amazon EKS to rotate cluster certificate authorities and reboot Amazon EC2 instances managed by EKS Auto Mode.| October 1, 2026
Diff
diff --git a/eks/latest/userguide/doc-history.md b/eks/latest/userguide/doc-history.md index 1098811..c44e0ed 100644 --- a//eks/latest/userguide/doc-history.md +++ b//eks/latest/userguide/doc-history.md @@ -20,0 +21 @@ Change| Description| Date +[AWS managed policy updates](https://docs.aws.amazon.com/eks/latest/userguide/security-iam-awsmanpol.html)| Added the `eks:CreateCertificateAuthority`, `eks:ActivateCertificateAuthority`, `eks:DeleteCertificateAuthority`, and `ec2:RebootInstances` permissions to `AmazonEKSServiceRolePolicy`. These permissions allow Amazon EKS to rotate cluster certificate authorities and reboot Amazon EC2 instances managed by EKS Auto Mode.| October 1, 2026