🧠 AWS EKS Cluster has node IAM role with AmazonEKS_CNI_Policy attached - prod.logic.yaml 🟢

• Contextual name: 🧠 prod.logic.yaml 🟢
• ID: /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml
• Located in: 📝 AWS EKS Cluster has node IAM role with AmazonEKS_CNI_Policy attached 🔴🟢

Flags

• 🟢 Logic test success
• 🟢 Logic with extracts
• 🟢 Logic with test data

Input Type

	Type	API Name	Extracts	Extract Files	Logic Files
🔒	📕 AWS EKS Cluster	CA10A1__CaAwsEksCluster__c	5	2	5

Uses

• 🔌 AWS IAM Role Policy Attachment - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-06-28T12:02:53.060112597Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 99	✔️ isDisappeared(CA10A1__disappearanceTime__c)	✔️ null
🟢	test2	✔️ 199	✔️ CA10A1__AWS_IAM_OpenID_Connect_Providers__r.hasNo(COMPLIANT)	✔️ null
🟢	test3	✔️ 299	✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(INCOMPLIANT)	✔️ null
🟢	test4	✔️ 399	✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)	✔️ null
🟢	test5	✔️ 399	✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)	✔️ null
🟢	test6	✔️ 600	✔️ otherwise	✔️ null
🟢	test7	✔️ 399	✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(COMPLIANT)	✔️ null
🟢	test8	✔️ 599	✔️ CA10A1__AWS_EKS_Cluster_Node_Groups__r.has(DISAPPEARED)	✔️ null

Generation

	File	MD5
Open	/ce/ca/aws/eks/cluster-node-role-cni-policy/policy.yaml	19D3B0D704B793A161B4817F8BFB1BA5
Open	/ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml	F0DE1E9DA2311DECDE9B869560671226
Open	/types/CA10__CaAwsIamRolePolicyAttachment__c/object.extracts.yaml	3B1645AD49B1ED98D792A387F70B5AA5
Open	/ce/ca/aws/eks/cluster-node-role-cni-policy/test-data.json	AE51C3A05ED54A87B496CBB93AFA19CE

Generate FULL script

java -jar repo-manager.jar policies generate FULL /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Generate DEBUG script

java -jar repo-manager.jar policies generate DEBUG /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Generate CAPTURE_TEST_DATA script

java -jar repo-manager.jar policies generate CAPTURE_TEST_DATA /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Generate TESTS script

java -jar repo-manager.jar policies generate TESTS /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Execute tests

java -jar repo-manager.jar policies test /ce/ca/aws/eks/cluster-node-role-cni-policy/prod.logic.yaml

Content

Open File

inputType: "CA10A1__CaAwsEksCluster__c"
importExtracts:
  - file: "/types/CA10__CaAwsIamRolePolicyAttachment__c/object.extracts.yaml"
testData:
  - file: "test-data.json"
conditions:
# VPC CNI plugin, as a prerequisite, requires an existing AWS IAM OIDC provider for the cluster.
# If the OIDC provider does not exist, the cluster is considered INAPPLICABLE since this topic is evaluated in /ce/ca/aws/eks/cluster-oidc-provider policy.
  - status: "INAPPLICABLE"
    currentStateMessage: "The VPC CNI plugin requires an existing IAM OpenID Connect (OIDC) provider for the cluster."
    check:
      RELATED_LIST_HAS_NO:
        status: "COMPLIANT"
        relationshipName: "CA10A1__AWS_IAM_OpenID_Connect_Providers__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "The EKS Cluster's node IAM role has the AmazonEKS_CNI_Policy attached."
    remediationMessage: "Consider configuring a separate IAM role with Amazon EKS CNI policy attached and annotating the aws-node service account with this role."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "COMPLIANT"
    currentStateMessage: "The EKS Cluster's node IAM role does not have the AmazonEKS_CNI_Policy attached"
    check:
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "UNDETERMINED"
    currentStateMessage: "Unable to determine the EKS Cluster's Node Groups."
    check:
      RELATED_LIST_HAS:
        status: "UNDETERMINED"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
  - status: "DISAPPEARED"
    currentStateMessage: "The EKS Cluster's Node Groups are deleted in the CMDB."
    check:
      RELATED_LIST_HAS:
        status: "DISAPPEARED"
        relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
otherwise:
  status: "UNDETERMINED" 
  currentStateMessage: "The EKS Cluster doesn't have any Node Groups in the CMDB."
relatedLists:
  - relationshipName: "CA10A1__AWS_IAM_OpenID_Connect_Providers__r"
    conditions: []
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "This is an IAM OpenID Connect Provider."
  - relationshipName: "CA10A1__AWS_EKS_Cluster_Node_Groups__r"
    conditions: 
      - status: "INCOMPLIANT" 
        currentStateMessage: "The Node Group's IAM role has the AmazonEKS_CNI_Policy attached."
        check:
          RELATED_LIST_HAS:
            status: "INCOMPLIANT"
            relationshipName: "CA10A1__nodeRole__r.CA10__AWS_IAM_Role_Policy_Attachments__r"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "The Node Group's IAM role does not have the AmazonEKS_CNI_Policy attached."
    relatedLists:
      - relationshipName: "CA10A1__nodeRole__r.CA10__AWS_IAM_Role_Policy_Attachments__r"
        conditions:
        #TODO: add an INCOMPLIANT check for exact policy permissions once supported
          - status: "INCOMPLIANT"
            currentStateMessage: "The AmazonEKS_CNI_Policy is attached to the node IAM role."
            check:
              IS_EQUAL:
                left:
                  EXTRACT: "CA10__policyArn__c"
                right:
                  TEXT: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
        otherwise:
          status: "INAPPLICABLE"
          currentStateMessage: "Unrelated IAM Policy."