AWS eks: EKS Auto Mode: NLB tag annotation not applied to shared backend SG
Summary
Clarifies in the annotation table and a new note that the `aws-load-balancer-additional-resource-tags` annotation is not applied to the shared backend security group, which must be tagged separately.
Security assessment
Documentation-only clarification about tag propagation to a shared backend security group; no security control, permission, or exposure change is described and no vulnerability is referenced.
Evidence
+ * EKS Auto Mode doesn’t apply tags from the `aws-load-balancer-additional-resource-tags` annotation to the backend security group that all load balancers in the cluster share. To tag this security group, add the tags separately.
Diff
diff --git a/eks/latest/userguide/auto-configure-nlb.md b/eks/latest/userguide/auto-configure-nlb.md index 1feb603..31765a4 100644 --- a//eks/latest/userguide/auto-configure-nlb.md +++ b//eks/latest/userguide/auto-configure-nlb.md @@ -75 +75 @@ Field | Description | Example -`aws-load-balancer-additional-resource-tags` | Additional AWS tags to apply to the load balancer and related resources. | `Environment=prod,Team=platform` +`aws-load-balancer-additional-resource-tags` | Additional AWS tags to apply to the load balancer and related resources. Not applied to the shared backend security group. | `Environment=prod,Team=platform` @@ -82,0 +83,2 @@ Field | Description | Example + * EKS Auto Mode doesn’t apply tags from the `aws-load-balancer-additional-resource-tags` annotation to the backend security group that all load balancers in the cluster share. To tag this security group, add the tags separately. +