EKS security

• Use network policies: kind: NetworkPolicy
• Use PrivateLink for AWS Services: ECR, S3, and CloudWatch

• AWS Config Security Best Practices for EKS

• Amazon EKS cluster endpoint access control: grep -ir cluster_endpoint_public_access *
• Logging Amazon EKS API calls with AWS CloudTrail

List of AWS Config Managed Rules

• eks-endpoint-no-public-access: ag -ir cluster_endpoint_public_access *
• eks-cluster-logging-enabled: ag -ir cluster_enabled_log_types * (["api", "audit", "authenticator", "controllerManager", "scheduler"])
• eks-cluster-log-enabled
• eks-cluster-oldest-supported-version
• eks-cluster-supported-version: ag -ir cluster_version *
• eks-cluster-secrets-encrypted: ag -ir cluster_encryption_config *
• eks-secrets-encrypted

Related

• EndpointPublicAccess
• K8s security
• EKS logging
• EKS versions
• cluster_security_group_additional_rules
• GKE security

See also

• EKS security, endpoint access control, Grant access, AWS Config Security Best Practices for EKS, List of AWS Config Managed Rules