AWS eks: EKS Auto Mode: IngressClassParams tags not applied to shared backend SG
Summary
Clarifies in the IngressClassParams field table and a new note that EKS Auto Mode does not apply `tags` to the shared backend security group used by all load balancers in the cluster, and that the security group must be tagged separately.
Security assessment
The change only documents tag-propagation behavior for a shared backend security group; it does not change or describe any access-control, encryption, or exposure behavior. Tagging guidance has governance/audit implications but no concrete vulnerability is addressed.
Evidence
+ * EKS Auto Mode doesn’t apply `tags` from IngressClassParams to the backend security group that all load balancers in the cluster share. To tag this security group, add the tags separately.
Diff
diff --git a/eks/latest/userguide/auto-configure-alb.md b/eks/latest/userguide/auto-configure-alb.md index 8c99aa1..029593a 100644 --- a//eks/latest/userguide/auto-configure-alb.md +++ b//eks/latest/userguide/auto-configure-alb.md @@ -231 +231 @@ Field | Description | Example value -`tags` | Custom tags for AWS resources | `Environment: prod, Team: platform` +`tags` | Custom tags for AWS resources. Not applied to the shared backend security group. | `Environment: prod, Team: platform` @@ -244,0 +245,2 @@ Field | Description | Example value + * EKS Auto Mode doesn’t apply `tags` from IngressClassParams to the backend security group that all load balancers in the cluster share. To tag this security group, add the tags separately. +