Amazon Elastic Kubernetes Service (EKS) enhanced security by supporting AWS PrivateLink for cluster OIDC discovery and JWKS endpoints used by IAM roles for service accounts. This allows tools inside a VPC to access OIDC endpoints privately, eliminating the need for internet connectivity.
With PrivateLink, developers can securely set up IRSA and validate tokens behind network firewalls. The feature also ensures correct DNS resolution when combined with EKS management VPC endpoints using private DNS. It is available at standard PrivateLink pricing in all regions where Amazon EKS operates.
Source & further reading
Amazon EKS now supports AWS PrivateLink for the cluster OIDC endpoint ↗Source published 2026-07-27. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.