[EKS] [request]: Provide IAM managed policy `AmazonEKS_CNI_IPv6_Policy` similar to `AmazonEKS_CNI_Policy` used for IPv4
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
- `AmazonEKS_CNI_IPv6_Policy` managed policy similar to `AmazonEKS_CNI_Policy` which is provided for IPv4 based clusters
- https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy
**Which service(s) is this request for?**
- EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
- Creating a policy is not challenging, however, it becomes challenging when trying to [best package up the policy for automation](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/32000068258828b812b3b6f76efcb2b452b810f3/node_groups.tf#L9-L47) since the policy creation is typically a 1-time task whereas cluster creation is a n-times task. Having a managed policy for IPv6 support makes this process transparent to most users as they will simply select either IPv4 or IPv6 when creating their cluster and the appropriate policy will be attached (likewise if using IRSA for the VPC-CNI addon instead of the node group role)
**Are you currently working around this issue?**
- Educating users to create the policy just once, typically outside the EKS cluster definition so that it can be re-used
**Additional context**
Anything else we should know?
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Review the AWS CNI IAM documentation linked in the issue and the referenced terraform-aws-eks node_groups.tf policy definition. Confirm the requested AmazonEKS_CNI_IPv6_Policy matches the documented IPv6 permissions and supports automated attachment alongside the IPv4 policy. Done means AWS provides the managed policy for EKS IPv6 clusters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, terraform
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100