aws / aws/aws-cdk

(aws-eks, aws-eks-v2): AccessEntry` with AccessEntryType.EC2 incorrectly prevents accessPolicies from being attached

Open
#37,496 3 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-eks-v2 bug effort/small p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When creating an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, providing `accessPolicies` throws a `ValidationError`:

> Access entry type 'EC2' cannot have access policies attached. Use AccessEntryType.STANDARD for access entries that require policies.

However, the AWS EKS API does allow access policies to be attached to `EC2` type access entries. The AWS Console and CLI both support this. Only the CDK validation blocks it.

The root cause is in the `validateAccessPoliciesForRestrictedTypes` method, which includes `AccessEntryType.EC2` in the restricted types list:

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-eks/lib/access-entry.ts#L453
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-eks-v2/lib/access-entry.ts#L458

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

`AccessEntry` with `accessEntryType: AccessEntryType.EC2` should allow `accessPolicies` to be specified, since the underlying AWS EKS API supports this.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/create-node-class.html#auto-node-access-entry

## Current Behavior

CDK throws a `ValidationError` when `accessPolicies` are provided for an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, even though the AWS API allows it.

### Current Behavior

CDK throws a `ValidationError` when `accessPolicies` are provided for an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, even though the AWS API allows it.

### Reproduction Steps

```python
from aws_cdk import aws_eks, aws_iam

cluster = aws_eks.Cluster(self, "MyCluster",
version=aws_eks.KubernetesVersion.V1_31,
)

node_role = aws_iam.Role(self, "NodeRole",
assumed_by=aws_iam.ServicePrincipal("ec2.amazonaws.com"),
)

# This throws ValidationError in CDK, but is valid in the AWS API
# NG
aws_eks.AccessEntry(self, "NodeAccessEntry",
cluster=cluster,
principal=node_role,
access_entry_type=aws_eks.AccessEntryType.EC2,
access_policies=[
aws_eks.AccessPolicy.from_access_policy_name("AmazonEKSClusterAdminPolicy",
access_scope_type=aws_eks.AccessScopeType.CLUSTER,
),
],
)

# OK
aws_eks.CfnAccessEntry(
self,
"NodeRoleAccessEntry",
cluster_name=cluster.cluster_name,
principal_arn=node_role.role_arn,
type="EC2",
access_policies=[
aws_eks.CfnAccessEntry.AccessPolicyProperty(
access_scope=aws_eks.CfnAccessEntry.AccessScopeProperty(
type="cluster",
),
policy_arn="arn:aws:eks::aws:cluster-access-policy/AmazonEKSAutoNodePolicy",
)
],
)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.246.0

### AWS CDK CLI version

2.1116.0

### Node.js Version

v24.14.1

### OS

macOS 26.2

### Language

Python

### Language Version

python(3.12.3)

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading validateAccessPoliciesForRestrictedTypes in packages/aws-cdk-lib/aws-eks/lib/access-entry.ts and packages/aws-cdk-lib/aws-eks-v2/lib/access-entry.ts, then compare the restriction with the linked AWS EKS documentation. Confirm that an EC2 AccessEntry with accessPolicies no longer raises the reported ValidationError in both implementations.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.