aws / aws/containers-roadmap

[EKS] [request]: Provide IAM managed policy `AmazonEKS_CNI_IPv6_Policy` similar to `AmazonEKS_CNI_Policy` used for IPv4

Open
#1,843 6 comments 36 reactions 0 assignees View on GitHub
EKS EKS Networking Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
- `AmazonEKS_CNI_IPv6_Policy` managed policy similar to `AmazonEKS_CNI_Policy` which is provided for IPv4 based clusters
- https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy

**Which service(s) is this request for?**
- EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
- Creating a policy is not challenging, however, it becomes challenging when trying to [best package up the policy for automation](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/32000068258828b812b3b6f76efcb2b452b810f3/node_groups.tf#L9-L47) since the policy creation is typically a 1-time task whereas cluster creation is a n-times task. Having a managed policy for IPv6 support makes this process transparent to most users as they will simply select either IPv4 or IPv6 when creating their cluster and the appropriate policy will be attached (likewise if using IRSA for the VPC-CNI addon instead of the node group role)

**Are you currently working around this issue?**
- Educating users to create the policy just once, typically outside the EKS cluster definition so that it can be re-used

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Review the AWS CNI IAM documentation linked in the issue and the referenced terraform-aws-eks node_groups.tf policy definition. Confirm the requested AmazonEKS_CNI_IPv6_Policy matches the documented IPv6 permissions and supports automated attachment alongside the IPv4 policy. Done means AWS provides the managed policy for EKS IPv6 clusters.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, terraform
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.