AWS eks: Add optional --configuration example for ACK capability creation

Service: eks · 2026-10-09 · Documentation low

File: eks/latest/userguide/ack-create-cli.md · Type: authz

Summary

Adds an optional 'Set ACK configuration options' step showing an aws eks create-capability command with --configuration JSON that sets ack.enableCrossNamespace to true and disables the s3 and ec2 service controllers. Also rewords the note about when CRDs are installed. Advises using update-capability instead of re-creating an existing capability.

Security assessment

This is configuration/CLI documentation. The example explicitly turns on cross-namespace reference resolution, a setting with access-scope implications, but it introduces no vulnerability, control, or advisory and merely shows how to set capability fields; the guidance is security-adjacent at most.

Evidence

+          "enableCrossNamespace": true,

Diff

diff --git a/eks/latest/userguide/ack-create-cli.md b/eks/latest/userguide/ack-create-cli.md
index a740c38..95dc1c6 100644
--- a//eks/latest/userguide/ack-create-cli.md
+++ b//eks/latest/userguide/ack-create-cli.md
@@ -80 +80 @@ Create the ACK capability resource on your cluster. Replace `region-code` with t
-The command returns immediately, but the capability takes some time to become active as EKS creates the required capability infrastructure and components. EKS will install the Kubernetes Custom Resource Definitions related to this capability in your cluster as it is being created.
+The command returns immediately, but the capability takes some time to become active as EKS creates the required capability infrastructure and components. EKS installs the Kubernetes Custom Resource Definitions related to this capability in your cluster as it creates the capability.
@@ -94,0 +95,21 @@ If you receive an error that the cluster doesn’t exist or you don’t have per
+### Set ACK configuration options (optional)
+
+To enable cross-namespace references or turn off specific ACK service controllers at creation, pass the `--configuration` parameter with an `ack` object. Run the following command **instead of** the command in the previous step, not in addition to it. It turns on cross-namespace reference resolution and disables the `s3` and `ec2` service controllers. For information about each field and its constraints, see [ACK capability configuration options](./create-ack-capability.html#ack-configuration-options).
+
+If you already created the capability, don’t run `create-capability` again. Change the configuration with `update-capability` instead, as described in [Update ACK capability configuration](./working-with-capabilities.html#ack-update-configuration).
+    
+    
+    aws eks create-capability \
+      --region region-code \
+      --cluster-name my-cluster \
+      --capability-name my-ack \
+      --type ACK \
+      --role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/ACKCapabilityRole \
+      --delete-propagation-policy RETAIN \
+      --configuration '{
+        "ack": {
+          "enableCrossNamespace": true,
+          "disabledServices": ["s3", "ec2"]
+        }
+      }'
+