(aws-eks, aws-eks-v2): AccessEntry` with AccessEntryType.EC2 incorrectly prevents accessPolicies from being attached
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When creating an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, providing `accessPolicies` throws a `ValidationError`:
> Access entry type 'EC2' cannot have access policies attached. Use AccessEntryType.STANDARD for access entries that require policies.
However, the AWS EKS API does allow access policies to be attached to `EC2` type access entries. The AWS Console and CLI both support this. Only the CDK validation blocks it.
The root cause is in the `validateAccessPoliciesForRestrictedTypes` method, which includes `AccessEntryType.EC2` in the restricted types list:
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-eks/lib/access-entry.ts#L453
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-eks-v2/lib/access-entry.ts#L458
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
`AccessEntry` with `accessEntryType: AccessEntryType.EC2` should allow `accessPolicies` to be specified, since the underlying AWS EKS API supports this.
Reference: https://docs.aws.amazon.com/eks/latest/userguide/create-node-class.html#auto-node-access-entry
## Current Behavior
CDK throws a `ValidationError` when `accessPolicies` are provided for an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, even though the AWS API allows it.
### Current Behavior
CDK throws a `ValidationError` when `accessPolicies` are provided for an `AccessEntry` with `accessEntryType: AccessEntryType.EC2`, even though the AWS API allows it.
### Reproduction Steps
```python
from aws_cdk import aws_eks, aws_iam
cluster = aws_eks.Cluster(self, "MyCluster",
version=aws_eks.KubernetesVersion.V1_31,
)
node_role = aws_iam.Role(self, "NodeRole",
assumed_by=aws_iam.ServicePrincipal("ec2.amazonaws.com"),
)
# This throws ValidationError in CDK, but is valid in the AWS API
# NG
aws_eks.AccessEntry(self, "NodeAccessEntry",
cluster=cluster,
principal=node_role,
access_entry_type=aws_eks.AccessEntryType.EC2,
access_policies=[
aws_eks.AccessPolicy.from_access_policy_name("AmazonEKSClusterAdminPolicy",
access_scope_type=aws_eks.AccessScopeType.CLUSTER,
),
],
)
# OK
aws_eks.CfnAccessEntry(
self,
"NodeRoleAccessEntry",
cluster_name=cluster.cluster_name,
principal_arn=node_role.role_arn,
type="EC2",
access_policies=[
aws_eks.CfnAccessEntry.AccessPolicyProperty(
access_scope=aws_eks.CfnAccessEntry.AccessScopeProperty(
type="cluster",
),
policy_arn="arn:aws:eks::aws:cluster-access-policy/AmazonEKSAutoNodePolicy",
)
],
)
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.246.0
### AWS CDK CLI version
2.1116.0
### Node.js Version
v24.14.1
### OS
macOS 26.2
### Language
Python
### Language Version
python(3.12.3)
### Other information
_No response_
Contributor guide
Research direction
Start by reading validateAccessPoliciesForRestrictedTypes in packages/aws-cdk-lib/aws-eks/lib/access-entry.ts and packages/aws-cdk-lib/aws-eks-v2/lib/access-entry.ts, then compare the restriction with the linked AWS EKS documentation. Confirm that an EC2 AccessEntry with accessPolicies no longer raises the reported ValidationError in both implementations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100