Skip to main content

🧠 AWS EKS Cluster has node IAM role with AmazonEKS_CNI_Policy attached - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2026-02-10T22:32:51.133417466Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢test1✔️ 99✔️ isDisappeared(CA10A1__disappearanceTime__c)✔️ null
🟢test2✔️ 199✔️ CA10A1__AWS_IAM_OpenID_Connect_Providers__r.hasNo(COMPLIANT)✔️ null
🟢test3✔️ 299✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(INCOMPLIANT)✔️ null
🟢test4✔️ 399✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)✔️ null
🟢test5✔️ 399✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)✔️ null
🟢test6✔️ 600✔️ otherwise✔️ null
🟢test7✔️ 399✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)✔️ null
🟢test8✔️ 599✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(DISAPPEARED)✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/aws/eks/cluster-node-role-cni-policy/policy.yaml19D3B0D704B793A161B4817F8BFB1BA5
Open/ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml8973C86330B3CC54A21A6898878453AF
Open/ce/ca/aws/eks/cluster-node-role-cni-policy/test-data.jsonAE51C3A05ED54A87B496CBB93AFA19CE
Open/types/CA10__CaAwsIamRolePolicyAttachment__c/object.extracts.yaml3B1645AD49B1ED98D792A387F70B5AA5

Available Commands​

repo-manager policies generate FULL /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Content​

Open File

inputType: "CA10A1__CaAwsEksCluster__c"
importExtracts:
  - file: "/types/CA10__CaAwsIamRolePolicyAttachment__c/object.extracts.yaml"
testData:
  - file: "test-data.json"
conditions:
# VPC CNI plugin, as a prerequisite, requires an existing AWS IAM OIDC provider for the cluster.
# If the OIDC provider does not exist, the cluster is considered INAPPLICABLE since this topic is evaluated in /ce/ca/aws/eks/cluster-oidc-provider policy.
  - status: "INAPPLICABLE"
    currentStateMessage: "The VPC CNI plugin requires an existing IAM OpenID Connect (OIDC) provider for the cluster."
    check:
      RELATED_LIST_HAS_NO:
        status: "COMPLIANT"
        relationshipName: "CA10A1__AWS_IAM_OpenID_Connect_Providers__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "The EKS cluster node IAM role has the AmazonEKS_CNI_Policy attached."
    remediationMessage: "Use a dedicated IAM role with the AmazonEKS_CNI_Policy attached and annotate the aws-node service account with this role."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "COMPLIANT"
    currentStateMessage: "The EKS cluster node IAM role does not have the AmazonEKS_CNI_Policy attached."
    check:
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "UNDETERMINED"
    currentStateMessage: "Unable to determine the EKS cluster node groups."
    check:
      RELATED_LIST_HAS:
        status: "UNDETERMINED"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "DISAPPEARED"
    currentStateMessage: "The EKS cluster node groups are deleted in the CMDB."
    check:
      RELATED_LIST_HAS:
        status: "DISAPPEARED"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
otherwise:
  status: "UNDETERMINED" 
  currentStateMessage: "The EKS cluster does not have any node groups in the CMDB."
relatedLists:
  - relationshipName: "CA10A1__AWS_IAM_OpenID_Connect_Providers__r"
    conditions: []
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "This is an IAM OpenID Connect (OIDC) provider."
  - relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
    conditions: 
      - status: "INCOMPLIANT" 
        currentStateMessage: "The node group's IAM role has the AmazonEKS_CNI_Policy attached."
        check:
          RELATED_LIST_HAS:
            status: "INCOMPLIANT"
            relationshipName: "CA10A1__nodeRole__r.CA10__AWS_IAM_Role_Policy_Attachments__r"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "The node group's IAM role does not have the AmazonEKS_CNI_Policy attached."
    relatedLists:
      - relationshipName: "CA10A1__nodeRole__r.CA10__AWS_IAM_Role_Policy_Attachments__r"
        conditions:
        #TODO: add an INCOMPLIANT check for exact policy permissions once supported
          - status: "INCOMPLIANT"
            currentStateMessage: "The AmazonEKS_CNI_Policy is attached to the node IAM role."
            check:
              IS_EQUAL:
                left:
                  EXTRACT: "CA10__policyArn__c"
                right:
                  TEXT: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
        otherwise:
          status: "INAPPLICABLE"
          currentStateMessage: "Unrelated IAM policy."