AWS eks: Document restricting HYBRID_LINUX/HYPERPOD_LINUX access entries

Service: eks · 2026-10-07 · Documentation medium

File: eks/latest/userguide/creating-access-entries.md · Type: authz

Summary

Adds a note that access entries of type `HYBRID_LINUX` or `HYPERPOD_LINUX` map the IAM role to `system:nodes` without requiring `iam:PassRole`, and that the `eks:accessEntryType` condition key can be used to restrict who can create them.

Security assessment

Documents an authorization nuance (access entries that require no `iam:PassRole` but grant `system:nodes`) and recommends an IAM condition key to constrain creation — defensible security guidance for cluster access control rather than a fix for a named vulnerability.

Evidence

+  * Access entries with type `HYBRID_LINUX` or `HYPERPOD_LINUX` associate the IAM role with the `system:nodes` Kubernetes group, but don’t require the `iam:PassRole` permission because Amazon EKS doesn’t assume the role. To restrict which IAM principals can create these access entries, use the `eks:accessEntryType` condition key. For more information, see [Conditions defined by Amazon Elastic Kubernetes Service](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html#amazonelastickubernetesservice-policy-keys) in the _Service Authorization Reference_.

Diff

diff --git a/eks/latest/userguide/creating-access-entries.md b/eks/latest/userguide/creating-access-entries.md
index be40ccd..922d9ff 100644
--- a//eks/latest/userguide/creating-access-entries.md
+++ b//eks/latest/userguide/creating-access-entries.md
@@ -74,0 +75,2 @@ Instead of, or in addition to, Kubernetes authorizing the IAM principal access t
+  * Access entries with type `HYBRID_LINUX` or `HYPERPOD_LINUX` associate the IAM role with the `system:nodes` Kubernetes group, but don’t require the `iam:PassRole` permission because Amazon EKS doesn’t assume the role. To restrict which IAM principals can create these access entries, use the `eks:accessEntryType` condition key. For more information, see [Conditions defined by Amazon Elastic Kubernetes Service](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html#amazonelastickubernetesservice-policy-keys) in the _Service Authorization Reference_.
+