cloudposse/terraform-aws-eks-cluster v4.15.0

on GitHub

• Attach AmazonEKSBlockStoragePolicyV2 instead of AmazonEKSBlockStoragePolicy to the cluster IAM role when Auto Mode is enabled.
• Update the Auto Mode section of the README accordingly.

why

• AWS's current Auto Mode setup documentation attaches AmazonEKSBlockStoragePolicyV2, not V1. A cluster built by this module today is flagged in the EKS console as missing the recommended policy.

• V2 is byte-identical to V1 apart from two statements, which gain a condition scoping them to the caller's own cluster:

  Statement	V1	V2
  ec2:CreateVolume on snapshot/*	no condition	aws:ResourceTag/eks:eks-cluster-name must equal aws:PrincipalTag/eks:eks-cluster-name
  ec2:CreateSnapshot on volume/*	no condition	same condition

  Every other statement, action, and resource is unchanged. So this is a tightening, not a feature change.

• Swapping rather than adding matters. IAM allows are additive, so attaching both leaves V1's unconditioned statements in force and V2 contributes nothing. The console warning goes quiet while the permissions stay wide.

Behavior change

For operators who create a volume from a snapshot not tagged with that cluster's eks:eks-cluster-name, or snapshot a volume not so tagged, those calls are now denied. Volumes and snapshots created by the cluster's own EBS CSI driver carry the tag, so the normal path is unaffected; cross-cluster or externally-created snapshot restores are the case to watch.

Happy to put this behind a variable instead if you would rather not change the default for existing users — say the word and I will push that version.

references

• Create an EKS Auto Mode Cluster with the AWS CLI — step 4 attaches AmazonEKSBlockStoragePolicyV2
• AmazonEKSBlockStoragePolicyV2 (created 2026-05-11)
• AmazonEKSBlockStoragePolicy (created 2024-10-30)