feat(eks): add support for EC2, HYBRID_LINUX, and HYPERPOD_LINUX access entry types #36350

pahud · 2025-12-09T22:32:27Z

Issue # (if applicable)

Reason for this change

When provisioning an EKS cluster in Auto Mode with custom node roles, users need to grant the node role access to the cluster with the EC2 access entry type. Currently, the grantAccess() method doesn't support specifying the access entry type, defaulting to STANDARD, which prevents nodes from joining Auto Mode clusters.

Additionally, the AccessEntryType enum is missing three CloudFormation-supported types: EC2, HYBRID_LINUX, and HYPERPOD_LINUX.

Description of changes

This PR adds support for specifying access entry types in the grantAccess() method and extends the AccessEntryType enum with missing CloudFormation-supported values.

Changes made:

Extended AccessEntryType enum with three new values:
- EC2 - For EKS Auto Mode node roles
- HYBRID_LINUX - For EKS Hybrid Nodes
- HYPERPOD_LINUX - For Amazon SageMaker HyperPod
Added optional accessEntryType parameter to Cluster.grantAccess() method
Updated private addToAccessEntry() method to pass type through to AccessEntry constructor
Applied changes to both @aws-cdk/aws-eks-v2-alpha (alpha) and aws-cdk-lib/aws-eks (stable) packages

API changes:

// Before (still works - backward compatible)
cluster.grantAccess('MyAccess', roleArn, [policy]);

// After (new capability)
cluster.grantAccess('MyAccess', roleArn, [policy], AccessEntryType.EC2);

CloudFormation impact:

When accessEntryType is provided: Type property is set in AWS::EKS::AccessEntry
When accessEntryType is not provided: Type property remains undefined (backward compatible)

No breaking changes: This is a fully backward-compatible feature addition. The new parameter is optional and placed at the end of the method signature. All existing code continues to work without modification.

Describe any new or updated permissions being added

N/A - No new IAM permissions required. This change only exposes existing CloudFormation access entry types through the CDK L2 API.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

- Add `grantAccessWithType` method to EKS cluster for type-safe access entry management - Update `AccessEntry` class to support access entry type configuration - Add integration test for EKS grant access with type functionality - Update README documentation with new access entry type feature - Generate snapshot files for integration test validation - Enable fine-grained access control for EKS cluster users and roles

github-actions · 2025-12-09T22:41:05Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	144 ran	144 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2025-12-09T22:41:07Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	144 ran	144 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

- Add concise README documentation for EC2, HYBRID_LINUX, and HYPERPOD_LINUX access entry types - Enhance JSDoc comments with detailed usage guidance and AWS service links - Document access policy constraints for non-STANDARD types - Update both stable and alpha packages consistently Addresses missing documentation for EKS Auto Mode, Hybrid Nodes, and SageMaker HyperPod integration.

…hanges - Update EKS grant access integration test snapshots with new asset hashes - Regenerate CloudFormation templates for cluster and kubectl providers - Update manifest and tree JSON files to reflect current state - Modify access entry implementation in both alpha and stable packages - Add test coverage for access entry type functionality - Update integration test to validate access entry type grants

- Add new asset snapshot for EKS grant access integration test - Reorganize asset directory structure with updated hash references - Update cfn-response.js, consts.js, and util.js asset files - Add new framework.js asset file to custom resource handler - Update CloudFormation template and assets manifest - Refresh tree.json and manifest.json for snapshot consistency - Remove obsolete asset files from previous snapshot version

…ult error

…with accessEntryType

Add missing declare statements for 'cluster' and 'nodeRole' variables in the access entry type documentation example to fix Rosetta compilation.

Abogical

~~I think grants in general should now use Grant classes instead of using grantX() methods. See #36616~~

~~I don't this will be accepted by our current linters.~~

Edit: This only applies to new grants.

Abogical · 2026-01-14T13:52:46Z

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

   * @returns {void}
   */
-  private addToAccessEntry(id: string, principal: string, policies: IAccessPolicy[]) {
+  private addToAccessEntry(id: string, principal: string, policies: IAccessPolicy[], accessEntryType?: AccessEntryType) {


Since this is a private method we can safely be able to change the API for this. We should change the arguments to take in a props argument. Something like:

Suggested change

private addToAccessEntry(id: string, principal: string, policies: IAccessPolicy[], accessEntryType?: AccessEntryType) {

interface AddAccessEntryOptions {

id: string,

principal: string,

policies: IAccessPolicy[],

accessEntryType?: AccessEntryType

}

private addToAccessEntry(props: AddAccessEntryOptions) {

This would be helpful in case we need to add further arguments to the method; It will be easier to update in the future.

Nice! Good catch! I'm on the way.

- Extract AddAccessEntryOptions interface for private addToAccessEntry method - Refactor addToAccessEntry to accept a props object instead of individual parameters - Update grantAccess to pass options object to addToAccessEntry - Apply changes to both stable and alpha EKS packages - Improves API stability for future method expansions

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

- Fix indentation from 3 spaces to 2 spaces for @MethodMetadata decorator - Apply fix to both stable and alpha EKS packages

- Fix closing */ comment indentation to match ESLint rules - Applied to both stable and alpha EKS packages

- Add GrantAccessOptions interface to provide extensible options - Update grantAccess method to use options object instead of direct accessEntryType parameter - Update unit tests to use new options object syntax - Apply changes to both stable and alpha EKS packages - Makes API more consistent and easier to extend in the future

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

- Add accessEntryType property to AccessEntry class to track entry type - Validate restricted access entry types (EC2, HYBRID_LINUX, HYPERPOD_LINUX) cannot have policies attached in addAccessPolicies() - Throw ValidationError with descriptive message when attempting to add policies to restricted types - Add comprehensive unit tests for both restricted and allowed access entry types - Apply changes to both aws-cdk-lib and aws-eks-v2-alpha packages - Prevents invalid configurations where certain access entry types should not have access policies

- Import Token from aws-cdk-lib/core in both access-entry.ts files - Add Token.isUnresolved() check before validating access policies length in constructor - Add Token.isUnresolved() check before validating access policies length in addAccessPolicies method - Prevent validation errors when access policies are defined as unresolved tokens (e.g., from Fn.importValue or other dynamic sources) - Apply changes to both @aws-cdk/aws-eks-v2-alpha and aws-cdk-lib packages for consistency

pahud · 2026-01-15T20:08:18Z

self-reviewed with no risks.

Abogical · 2026-01-16T09:01:07Z

packages/@aws-cdk/aws-eks-v2-alpha/lib/access-entry.ts

+    // Validate that restricted access entry types cannot have access policies
+    const restrictedTypes = [AccessEntryType.EC2, AccessEntryType.HYBRID_LINUX, AccessEntryType.HYPERPOD_LINUX];
+    if (this.accessEntryType && restrictedTypes.includes(this.accessEntryType) && newAccessPolicies.length > 0) {
+      throw new ValidationError(`Access entry type '${this.accessEntryType}' cannot have access policies attached. Use AccessEntryType.STANDARD for access entries that require policies.`, this);
+    }


As this validation logic is repeated, it can be moved to a single re-usable private method which can be re-used here and in the constructor.

Abogical · 2026-01-16T09:02:54Z

packages/@aws-cdk/aws-eks-v2-alpha/lib/access-entry.ts

    const restrictedTypes = [AccessEntryType.EC2, AccessEntryType.HYBRID_LINUX, AccessEntryType.HYPERPOD_LINUX];
-    if (props.accessEntryType && restrictedTypes.includes(props.accessEntryType) && props.accessPolicies.length > 0) {
+    if (props.accessEntryType && restrictedTypes.includes(props.accessEntryType) &&
+        !Token.isUnresolved(props.accessPolicies) && props.accessPolicies.length > 0) {


Good catch to check for tokens

- Extract duplicate validation logic into private validateAccessPoliciesForRestrictedTypes method - Remove repeated restricted types array and validation checks from constructor and addAccessPolicies - Add comprehensive JSDoc documentation for the new private method - Apply changes to both aws-eks and aws-eks-v2-alpha packages for consistency - Improves code maintainability and reduces duplication across validation points

- Add missing closing brace for validateAccessPolicies method - Fixes syntax error that prevented proper method termination - Ensures accessEntryRef getter is properly defined after validation logic

- Replace old AWS CLI layer asset with updated version - Update asset hashes and S3 object keys in CloudFormation template - Rename EC2 role and access entry resources for clarity - Remove HYBRID_LINUX and HYPERPOD access entry types from test - Update manifest and tree.json snapshots to reflect changes - Add ClusterClusterAdminRoleAccessF2BFF759 dependency to kubectl-ready output

mergify · 2026-02-03T11:00:38Z

Thank you for contributing! Your pull request will be automatically updated and merged (do not update manually, and be sure to allow changes to be pushed to your fork).

- Separate type-only imports using `type` keyword in access-entry.ts files - Remove duplicate import statements in cluster.ts files - Consolidate imports from './access-entry' module with proper type separation - Apply consistent import organization pattern across aws-eks and aws-eks-v2-alpha packages - Align with established type-only import enforcement standards

mergify · 2026-02-03T17:52:01Z

Thank you for contributing! Your pull request will be automatically updated and merged (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-02-03T17:52:37Z

github-actions · 2026-02-03T18:31:54Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added feature-request A feature should be added or improved. p2 labels Dec 9, 2025

aws-cdk-automation requested a review from a team December 9, 2025 22:32

mergify bot added the contribution/core This is a PR that came from AWS. label Dec 9, 2025

pahud added 2 commits January 13, 2026 12:59

Merge branch 'main' into fix-34394-eks-access-entry-types

d47bf1e

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Jan 13, 2026

pahud mentioned this pull request Jan 13, 2026

Failed CodeBuild CI - 25 PR(s) need attention pahud/aws-cdk#17

Open

pahud self-assigned this Jan 13, 2026

pahud marked this pull request as ready for review January 13, 2026 21:03

pahud added 3 commits January 13, 2026 17:18

fix(eks-v2-alpha): fix eslint errors for trailing spaces and non-defa…

2565951

…ult error

test(eks): add unit tests for new access entry types and grantAccess …

d213ee0

…with accessEntryType

fix(eks): add declare statements to README code example for Rosetta

214ab61

Add missing declare statements for 'cluster' and 'nodeRole' variables in the access entry type documentation example to fix Rosetta compilation.

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 14, 2026

Abogical requested changes Jan 14, 2026

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 14, 2026

Abogical self-requested a review January 14, 2026 10:54

Abogical requested changes Jan 14, 2026

View reviewed changes

packages/aws-cdk-lib/aws-eks/lib/cluster.ts Outdated Show resolved Hide resolved

pahud added 5 commits January 14, 2026 11:20

fix: correct indentation in grantAccess method

9a7c715

- Fix indentation from 3 spaces to 2 spaces for @MethodMetadata decorator - Apply fix to both stable and alpha EKS packages

style: fix JSDoc comment indentation

a230fa7

- Fix closing */ comment indentation to match ESLint rules - Applied to both stable and alpha EKS packages

fix(eks): update integration test to use options object for grantAccess

6bab98a

fix(eks): use GrantAccessOptions object in integ test

5b7b2bb

Abogical added the pr/requires-two-approvers This PR is critical (e.g., security, broadly-impacting) and requires 2 approvers to be merged. label Jan 15, 2026

Abogical requested changes Jan 15, 2026

View reviewed changes

packages/aws-cdk-lib/aws-eks/lib/cluster.ts Show resolved Hide resolved

pahud added 2 commits January 15, 2026 14:45

pahud requested a review from Abogical January 15, 2026 20:08

Abogical requested changes Jan 16, 2026

View reviewed changes

Abogical reviewed Jan 16, 2026

View reviewed changes

pahud added 2 commits January 20, 2026 09:55

Merge branch 'main' into fix-34394-eks-access-entry-types

9e590ce

Abogical approved these changes Jan 20, 2026

View reviewed changes

fix(eks): add missing closing brace in AccessEntry validation

0edb1d2

- Add missing closing brace for validateAccessPolicies method - Fixes syntax error that prevented proper method termination - Ensures accessEntryRef getter is properly defined after validation logic

Abogical approved these changes Jan 20, 2026

View reviewed changes

pahud mentioned this pull request Jan 21, 2026

PRs with Conflicts - 27 PR(s) need attention pahud/aws-cdk#13

Open

pahud added 4 commits January 23, 2026 20:41

Merge branch 'main' into fix-34394-eks-access-entry-types

3f9217d

fix(eks): remove trailing space in access-entry.ts

608f847

fix(eks): remove duplicate import in access-entry.ts

10fc213

Abogical approved these changes Feb 2, 2026

View reviewed changes

gasolima approved these changes Feb 3, 2026

View reviewed changes

pahud added 2 commits February 3, 2026 11:53

Merge branch 'main' into fix-34394-eks-access-entry-types

66147a0

aws-cdk-automation removed the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Feb 3, 2026

Merge branch 'main' into fix-34394-eks-access-entry-types

29c3210

mergify bot merged commit cc059c6 into aws:main Feb 3, 2026
22 of 23 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Feb 3, 2026

feat(eks): add support for EC2, HYBRID_LINUX, and HYPERPOD_LINUX access entry types #36350

feat(eks): add support for EC2, HYBRID_LINUX, and HYPERPOD_LINUX access entry types #36350

Uh oh!

Conversation

pahud commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Checklist

Uh oh!

github-actions bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Abogical left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Abogical Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

pahud Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pahud commented Jan 15, 2026

Uh oh!

Abogical Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

pahud Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Abogical Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Feb 3, 2026

Uh oh!

mergify bot commented Feb 3, 2026

Uh oh!

mergify bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pahud commented Dec 9, 2025 •

edited

Loading

github-actions bot commented Dec 9, 2025 •

edited

Loading

github-actions bot commented Dec 9, 2025 •

edited

Loading

Abogical left a comment •

edited

Loading

mergify bot commented Feb 3, 2026 •

edited

Loading