diff --git a/docs/docs/reference/cli.md b/docs/docs/reference/cli.md
index fd32c54cd..35a5289d9 100644
--- a/docs/docs/reference/cli.md
+++ b/docs/docs/reference/cli.md
@@ -35,6 +35,8 @@ Commands:
     * [azure](#constellation-iam-create-azure): Create IAM configuration on Microsoft Azure for your Constellation cluster
     * [gcp](#constellation-iam-create-gcp): Create IAM configuration on GCP for your Constellation cluster
   * [destroy](#constellation-iam-destroy): Destroy an IAM configuration and delete local Terraform files
+  * [upgrade](#constellation-iam-upgrade): Find and apply upgrades to your IAM profile
+    * [apply](#constellation-iam-upgrade-apply): Apply an upgrade to an IAM profile
 * [version](#constellation-version): Display version of this CLI
 
 ## constellation config
@@ -725,6 +727,58 @@ constellation iam destroy [flags]
       --tf-log string   Terraform log level (default "NONE")
 ```
 
+## constellation iam upgrade
+
+Find and apply upgrades to your IAM profile
+
+### Synopsis
+
+Find and apply upgrades to your IAM profile.
+
+### Options
+
+```
+  -h, --help   help for upgrade
+```
+
+### Options inherited from parent commands
+
+```
+      --config string   path to the configuration file (default "constellation-conf.yaml")
+      --debug           enable debug logging
+      --force           disable version compatibility checks - might result in corrupted clusters
+      --tf-log string   Terraform log level (default "NONE")
+```
+
+## constellation iam upgrade apply
+
+Apply an upgrade to an IAM profile
+
+### Synopsis
+
+Apply an upgrade to an IAM profile.
+
+```
+constellation iam upgrade apply [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for apply
+  -y, --yes    run upgrades without further confirmation
+               
+```
+
+### Options inherited from parent commands
+
+```
+      --config string   path to the configuration file (default "constellation-conf.yaml")
+      --debug           enable debug logging
+      --force           disable version compatibility checks - might result in corrupted clusters
+      --tf-log string   Terraform log level (default "NONE")
+```
+
 ## constellation version
 
 Display version of this CLI
diff --git a/docs/docs/reference/migration.md b/docs/docs/reference/migration.md
index 319c70106..d8cfbb35f 100644
--- a/docs/docs/reference/migration.md
+++ b/docs/docs/reference/migration.md
@@ -13,6 +13,11 @@ Use [`constellation config migrate`](./cli.md#constellation-config-migrate) to a
   2. Set `useManagedIdentityExtension` to `true`  and use the `userAssignedIdentity` from the Constellation config for the value of `userAssignedIdentityID`.
   3. Restart the CSI driver, cloud controller manager, cluster autoscaler, and Constellation operator pods.
 
+
+## Migrating from CLI versions before 2.10
+
+- AWS cluster upgrades require additional iam permissions for the newly introduced `aws-load-balancer-controller`. Please perform an upgrade through `iam upgrade apply` which will show the needed changes and ask to confirm them before applying.
+
 ## Migrating from CLI versions before 2.9
 
 - The `provider.azure.appClientID` and `provider.azure.clientSecretValue` fields were removed to enforce migration to managed identity authentication