aws / aws/containers-roadmap

[EKS Auto Mode] [Request]: EKS Auto Mode incompatible with secure Service Control Policies

Open
#2,624 6 comments 2 reactions 0 assignees View on GitHub
EKS EKS Auto Mode Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Please enable instanceProfile in the NodeClass API for EKS Auto.

**Which service(s) is this request for?**
EKS (Auto)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
#### TLDR: Lack of ability to use pre-defined InstanceProfile is incompatible with secure multi-account security principles.

1. We utilise secure Service Control Policies in our org which block non-CD accounts from performing role-based IAM actions, e.g. AddRoleToInstanceProfile, CreateInstanceProfile, CreateRole, etc.
2. When EKS Auto was adapted from Karpenter , several features were dropped when porting EC2NodeClass to NodeClass. One of these was the ability to reference instanceProfile instead of role.
3. EKS Auto seems to want to create a dedicated instanceProfile per node-pool and then add the node role to this instance profile at run-time.
4. Our SCP forbids any "user-facing" process from changing roles. Hence we are hard-blocked from adoption right now.

**Are you currently working around this issue?**
No workaround possible.

Contributor guide

Open the contributing guide

Research direction

Review the EKS Auto NodeClass API, its relationship to the earlier EC2NodeClass, and the requested instanceProfile capability. Read the stated Service Control Policy restrictions and verify that the result supports a pre-defined instance profile without runtime role or instance-profile changes; done means EKS Auto can operate under those policies.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
authorization, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.