A Kubernetes security checklist, read against EKS
A Kubernetes security checklist, read against EKS
A Kubernetes security checklist, read against EKS
krol3/kubernetes-security-checklist is a single README by Carol Valencia, Apache-2.0, 49 stars, last changed 18 January 2023 (6557c71). It is organised around the 4C model — cloud, cluster, container, code — and covers:- Infrastructure: API server and node network access, cloud IAM, etcd, host benchmarks, patching, certificates.
- Security features: RBAC, SSO, secrets, pod security, network policy, audit.
- Supply chain: image signing, admission verification, SBOM.
- Common attacks, with the control for each, and a short tools and guides list.
This page reads it for one question: on Amazon EKS, which checklist items does AWS do for you, which have an AWS service you switch on, and which stay yours? The RBAC section gets the most space, because it is where EKS differs most from a self-managed cluster.
The services themselves are described in EKS security with AWS services only ; this page links to it instead of repeating it.
Item by item
"AWS" means EKS does it and you cannot change it. "AWS service" means there is a managed service or setting, but you have to turn it on. "Yours" means nothing in AWS does it.
Kubernetes infrastructure
| checklist item | on EKS | who |
|---|---|---|
| Limit access to the API server to trusted networks | the cluster endpoint: public, private, or both, with a CIDR allowlist on the public side. Public access is on by default at create | AWS service — set endpointPrivateAccess, and either turn public access off or restrict publicAccessCidrs. Security Hub control EKS.1 flags a public endpoint |
| Limit network access to nodes | node security groups; the nodes sit in your VPC subnets | yours |
| Least privilege for the cloud provider's IAM | IAM roles for the cluster, the nodes and each workload | yours, with IAM Access Analyzer to find unused permissions |
| Limit access to etcd | etcd is inside the EKS control plane; you have no network path to it | AWS |
| Encrypt etcd | envelope encryption of Kubernetes API data with KMS is on by default from 1.28; you can supply your own KMS key | AWS, with an optional customer key. Control EKS.3 |
| TLS to etcd; is etcd limited to the control plane? | not visible or configurable | AWS |
| Host benchmark (OpenSCAP, OVAL, CIS) | EKS-optimised AMIs and Bottlerocket are the base. Auto Mode nodes are AWS-managed | yours on managed and self-managed node groups — run kube-bench with its EKS profile; AWS ships the image on Auto Mode |
| Updates and patches | the control plane is patched by EKS; the Kubernetes minor version is upgraded by you | split: control plane AWS, version upgrade and nodes yours (AWS on Auto Mode). Controls EKS.2 and EKS.9 flag unsupported versions |
| Certificates for ingress and pod-to-pod mTLS | ACM certificates on the ALB or NLB for ingress; ACM Private CA for internal PKI, which cert-manager can issue from through its AWS PCA issuer | AWS service for ingress; yours to wire mTLS inside the cluster (a mesh or cert-manager) |
Kubernetes security features
| checklist item | on EKS | who |
|---|---|---|
| Authorization: RBAC | Kubernetes RBAC, unchanged; EKS adds access entries in front of it | see the RBAC section below |
| Authentication: SSO | IAM is the built-in authenticator, so IAM Identity Center or any IAM federation is SSO. An external OIDC provider can also be associated with the cluster | AWS service |
| Secrets management | see Secrets below | — |
| Pod Security Policy | removed in Kubernetes 1.25. Its replacement, Pod Security Admission, is built into every supported EKS version | yours — a namespace label |
| Network policy | Kubernetes NetworkPolicy, enforced by the VPC CNI when network policy is enabled on the add-on, or by Auto Mode | AWS service; the policies themselves are yours |
| Audit the API server | control-plane audit logs to CloudWatch Logs, off by default; GuardDuty EKS Protection reads the audit stream independently | AWS service. Control EKS.8 flags audit logging off |
Kubernetes pod security
| checklist item | on EKS | who |
|---|---|---|
| Pod Security Standards: restricted, baseline, privileged | Pod Security Admission, per namespace. Finer rules (allowed registries, required limits) need Kyverno or Gatekeeper | yours — no AWS service decides admission |
| Security context per pod or container | plain Kubernetes | yours, enforced by the admission policy above |
| A runtime with stronger isolation | Fargate runs each pod in its own microVM; there is no managed gVisor or Kata on EC2 nodes | AWS service if Fargate fits the workload (no DaemonSets, no privileged pods, no GPUs); otherwise yours |
Kubernetes secrets
| checklist item | on EKS | who |
|---|---|---|
| Encrypt all secrets | at rest in etcd: envelope encryption, on by default. In use: Secrets Manager, mounted through the Secrets Store CSI Driver and its AWS provider | AWS at rest; AWS service for an external store |
| Mozilla SOPS | for secrets kept in Git; SOPS supports AWS KMS as a key source | yours, with KMS as the key |
| Cloud key management | AWS KMS | AWS service |
Kubernetes networking
| checklist item | on EKS | who |
|---|---|---|
| Network policy for ingress and egress | VPC CNI network policy (above), plus security groups for pods for traffic that leaves the cluster to RDS or other VPC resources | AWS service for enforcement; the policies are yours |
| "Nano segmentation" | per-pod NetworkPolicy selectors; L7 segmentation needs a mesh | yours |
The checklist's own line — when's the last time anyone discovered a sophisticated attack from a packet capture in Kubernetes? — holds on AWS too. VPC Flow Logs see ENI-level flows, not pods by name; GuardDuty Runtime Monitoring sees process and network events on the node, which is the useful layer.
Kubernetes supply chain
| checklist item | on EKS | who |
|---|---|---|
| Image signing (Cosign, Notary) | AWS Signer signs container images in ECR using the Notation (Notary Project) format; Cosign signatures can also be stored in ECR as OCI artifacts | AWS service to sign; both cosign and notation are active projects |
| Admission controller that verifies signatures | no managed admission. Kyverno, Gatekeeper with Ratify, or the AWS Signer plugin for Notation's verifier, run by you | yours |
| SCA and SBOM | Amazon Inspector scans ECR images and can export SBOMs | AWS service |
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article