CIS Amazon Elastic Kubernetes Service (EKS) Benchmark

Enable Audit Logs
Profile Applicability: • Level 1 Description:  Control plane logs provide visibility into the operation of the EKS control plane component systems. The AP...
Tue, 22 Apr, 2025 at 7:47 AM
Ensure Audit Logs are Collected and Managed
Profile Applicability:  • Level 1 Description: Ensure that audit logs are collected and managed in accordance with the enterprise’s audit log management pr...
Wed, 23 Apr, 2025 at 12:54 AM
Ensure that the kubeconfig file permissions are set to 644 or More Restrictive
Profile Applicability: • Level 1 Description:  If the kubelet is running, and it is configured using a kubeconfig file, ensure that the file permissions a...
Wed, 23 Apr, 2025 at 12:58 AM
Ensure that the kubelet kubeconfig file ownership is set to root:root
Profile Applicability:  • Level 1 Description:  If the kubelet is running, ensure that the ownership of its kubeconfig file is set to root:root. This owner...
Wed, 23 Apr, 2025 at 1:01 AM
Ensure that the kubelet configuration file has permissions set to 644 or More Restrictive
Profile Applicability:  • Level 1 Description:  Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permiss...
Wed, 23 Apr, 2025 at 1:04 AM
Ensure that the kubelet configuration file ownership is set to root:root
Profile Applicability: • Level 1 Description:  Ensure that if the kubelet refers to a configuration file via the --config argument, the file is owned by r...
Wed, 23 Apr, 2025 at 1:05 AM
Ensure that the Anonymous Auth is Not Enabled
Profile Applicability: • Level 1 Description:  Ensure that anonymous requests to the Kubelet server are disabled. Anonymous access should be restricted, r...
Wed, 23 Apr, 2025 at 1:11 AM
Ensure that the authorization mode Argument is Not Set to AlwaysAllow
Profile Applicability:  • Level 1 Description:  Do not allow all requests. Ensure that explicit authorization is enforced by setting the authorization-mode...
Wed, 23 Apr, 2025 at 1:15 AM
Ensure that a Client CA File is Configured
Profile Applicability:  • Level 1 Description:  Ensure that the Kubelet is configured to authenticate using certificates by setting the client certificate ...
Wed, 23 Apr, 2025 at 1:18 AM
Ensure that the read-only-port is Disabled
Profile Applicability:  • Level 1 Description:  Disable the Kubelet’s read-only port to prevent unauthenticated access to potentially sensitive information...
Wed, 23 Apr, 2025 at 1:21 AM