AWS eks: Document new CA and EC2 reboot permissions in AmazonEKSServiceRolePolicy
Summary
Updates the AmazonEKSServiceRolePolicy description to note that ec2 permissions now include rebooting EKS Auto Mode instances and that eks permissions now include creating, activating, and deleting cluster certificate authorities; also adds a changelog row for the permission additions.
Security assessment
The change documents newly granted IAM permissions on a service-linked role, including certificate authority lifecycle operations (relevant to cluster TLS trust) and EC2 instance reboot. It is permission-boundary/least-privilege relevant documentation, but no specific vulnerability or CVE is referenced, so severity is medium.
Evidence
+ * **`eks` ** \- Create, activate, and delete certificate authorities for EKS clusters. Manage cluster access entries and policies, allowing fine-grained control over who can access EKS resources and what actions they can perform. This includes associating standard access policies for compute, networking, load balancing, and storage operations.
Diff
diff --git a/eks/latest/userguide/security-iam-awsmanpol.md b/eks/latest/userguide/security-iam-awsmanpol.md index ed5a744..048736a 100644 --- a//eks/latest/userguide/security-iam-awsmanpol.md +++ b//eks/latest/userguide/security-iam-awsmanpol.md @@ -331 +331 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`ec2` Auto Mode** – Terminate EC2 instances created by EKS Auto Mode. For more information, see [Automate cluster infrastructure with EKS Auto Mode](./automode.html). + * **`ec2` Auto Mode** – Terminate or reboot Amazon EC2 instances managed by EKS Auto Mode. For more information, see [Automate cluster infrastructure with EKS Auto Mode](./automode.html). @@ -341 +341 @@ This policy includes the following permissions that allow Amazon EKS to complete - * **`eks` ** \- Manage cluster access entries and policies, allowing fine-grained control over who can access EKS resources and what actions they can perform. This includes associating standard access policies for compute, networking, load balancing, and storage operations. + * **`eks` ** \- Create, activate, and delete certificate authorities for EKS clusters. Manage cluster access entries and policies, allowing fine-grained control over who can access EKS resources and what actions they can perform. This includes associating standard access policies for compute, networking, load balancing, and storage operations. @@ -541,0 +542 @@ Change | Description | Date +Added permissions to AmazonEKSServiceRolePolicy. | Added the `eks:CreateCertificateAuthority`, `eks:ActivateCertificateAuthority`, `eks:DeleteCertificateAuthority`, and `ec2:RebootInstances` permissions. These permissions allow Amazon EKS to rotate cluster certificate authorities and reboot Amazon EC2 instances managed by EKS Auto Mode. | October 1, 2026