Amazon EKS enhances cluster governance with new IAM condition keys

Amazon EKS IAM Condition Keys Update

Amazon Elastic Kubernetes Service (EKS) now supports seven additional IAM condition keys for cluster creation and configuration APIs, enhancing governance controls through IAM policies and Service Control Policies (SCPs). This update enables organizations to enforce security and compliance requirements across all clusters in multi-account environments.

New IAM Condition Keys

• eks:endpointPublicAccess and eks:endpointPrivateAccess for private-only API endpoints
• eks:encryptionConfigProviderKeyArns for customer-managed AWS KMS keys for secrets encryption
• eks:kubernetesVersion to restrict clusters to approved Kubernetes versions
• eks:deletionProtection to mandate deletion protection for production workloads
• eks:controlPlaneScalingTier to specify control plane scaling tiers
• eks:zonalShiftEnabled to enable zonal shift capabilities for high availability

These condition keys apply to CreateCluster, UpdateClusterConfig, UpdateClusterVersion, and AssociateEncryptionConfig APIs, integrating with AWS Organizations SCPs for centralized governance.

The new IAM condition keys are available in all AWS Regions where Amazon EKS is available at no additional charge.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.