Amazon EKS enables per-pod ECR image pull permissions for granular access
Amazon EKS now provides full support for per-pod ECR image pull permissions, enabling granular access control in multi-tenant clusters. This capability leverages Kubernetes KEP 4412, available on EKS v1.35+, allowing pods to use specific IAM roles for ECR authentication instead of shared node credentials. It significantly enhances security and isolation by ensuring each application can only pull images from its designated repositories. Platform teams can enforce fine-grained access using ECR repository policies alongside these pod-specific IAM roles.
Features (1) ›
- Per-pod Amazon ECR image pull permissions on Amazon EKS
Amazon EKS now fully supports per-pod Amazon ECR image pull permissions using the ecr-credential-provider and ECR repository policies. This capability, enabled by Kubernetes KEP 4412 and available on EKS v1.35 or later, allows pods to assume specific IAM roles for image pulls, moving beyond node-level authentication. This enhances security and isolation in multi-tenant clusters by scoping access to individual ECR repositories.
https://aws.amazon.com/blogs/containers/implement-per-pod-image-pull-permissions-with-ecr-repository-policies-on-amazon-eks/
Related releases
- AWS Resilience Hub Adds Three New Capabilities AWS What's New ·
- AWS Elastic Beanstalk introduces Cluster Mode for shared infrastructure application deployment AWS What's New ·
- AWS Private CA EKS Add-on and AD Connector Available in GovCloud (US) AWS What's New ·
- Amazon EMR Extends No-Cost Support for Older Releases During Migrations AWS What's New ·
- AWS Config expands support for 60 new resource types AWS What's New ·
- Kyverno Automates Proxy Injection for EKS on Fargate AWS Containers Blog ·