CIS Amazon Elastic Kubernetes Service (EKS) Benchmark
46 articles
- Enable Audit Logs
- Ensure Audit Logs are Collected and Managed
- Ensure that the kubeconfig file permissions are set to 644 or More Restrictive
- Ensure that the kubelet kubeconfig file ownership is set to root:root
- Ensure that the kubelet configuration file has permissions set to 644 or More Restrictive
- Ensure that the kubelet configuration file ownership is set to root:root
- Ensure that the Anonymous Auth is Not Enabled
- Ensure that the authorization mode Argument is Not Set to AlwaysAllow
- Ensure that a Client CA File is Configured
- Ensure that the read-only-port is Disabled
- Ensure that the --streaming-connection-idle-timeout argument is not set to 0
- Ensure that the --make-iptables-util-chains argument is set to True
- Ensure Proper Event Capture Rate for Kubelet
- Ensure that the --rotate-certificates Argument is Not Present or is Set to True (Automated)
- Ensure that the rotate certificates Argument is Set to True
- Ensure that the cluster admin Role is Only Used Where Required
- Minimize Access to Secrets
- Minimize Wildcard Use in Roles and ClusterRoles
- Minimize Access to Create Pods (Automated)
- Ensure that Default Service Accounts Are Not Actively Used
- Ensure that Service Account Tokens Are Only Mounted Where Necessary
- Use Cluster Access Manager API for Access Control Management
- Limit Use of the Bind, Impersonate, and Escalate Permissions in the Kubernetes Cluster
- Minimize the Admission of Privileged Containers
- Minimize the Admission of Containers Wishing to Share the Host Process ID Namespace (Automated)
- Minimize the Admission of Containers Wishing to Share the Host IPC Namespace (Automated)
- Minimize the Admission of Containers Wishing to Share the Host Network Namespace (Automated)
- Minimize the Admission of Containers with allowPrivilegeEscalation
- Ensure CNI Plugin Supports Network Policies
- Ensure that all Namespaces Have Network Policies Defined
- Prefer Using Secrets as Files Over Secrets as Environment Variables
- Consider External Secret Storage
- Create Administrative Boundaries Between Resources Using Namespaces
- The Default Namespace Should Not Be Used
- Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third-party provider
- Minimize user access to Amazon ECR
- Minimize cluster access to read-only for Amazon ECR
- Minimize Container Registries to only those approved
- Prefer using dedicated EKS Service Accounts
- Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS
- Restrict Access to the Control Plane Endpoint
- Ensure Clusters are Created with Private Endpoint Enabled and Public Access Disabled
- Ensure Clusters are Created with Private Nodes
- Ensure Network Policy is Enabled and Set as Appropriate
- Encrypt Traffic to HTTPS Load Balancers with TLS Certificates
- Manage Kubernetes RBAC Users with AWS IAM Authenticator for Kubernetes or Upgrade to AWS CLI v1.16.156 or Greater