Skip to content

DOC: Added the description of the changes in access policies regarding WebSocket-related subresources #1116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: mainline
Choose a base branch
from
+9 −0
Open

DOC: Added the description of the changes in access policies regarding WebSocket-related subresources #1116

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions latest/ug/manage-access/k8s-access/access-policy-reference.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,15 @@ include::../../attributes.txt[]

Access policies include `rules` that contain Kubernetes `verbs` (permissions) and `resources`. Access policies don't include IAM permissions or resources. Similar to Kubernetes `Role` and `ClusterRole` objects, access policies only include `allow` `rules`. You can't modify the contents of an access policy. You can't create your own access policies. If the permissions in the access policies don't meet your needs, then create Kubernetes RBAC objects and specify _group names_ for your access entries. For more information, see <<creating-access-entries>>. The permissions contained in access policies are similar to the permissions in the Kubernetes user-facing cluster roles. For more information, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles[User-facing roles] in the Kubernetes documentation.

[NOTE]
====
Starting on Kubernetes 1.31, Kubernetes uses the WebSocket protocol instead of SPDY for streaming. Following this transition, the subresources `pods/attach`, `pods/exec`, `pods/portforward`, `pods/proxy` and `nodes/proxy` were accessible through a `GET` with Upgrade header instead of only `CREATE`.

As a result, this allowed users with read-only access to be able to execute streaming commands, like `exec` and `port-forward`, exposing a significant security gap.

In order to prevent this behavior, the only access policies with permissions for the subresources (`pods/attach`, `pods/exec`, `pods/portforward`, `pods/proxy` and `nodes/proxy`) are: `AmazonEKSAdminPolicy`, `AmazonEKSClusterAdminPolicy` and `AmazonEKSEditPolicy`
====

[#access-policies-cli-command]
== List all policies
Use any one of the access policies listed on this page, or retrieve a list of all available access policies using the {aws} CLI:
Expand Down