Amazon EKS — Security Best Practices

1 minute read

EKS Security Best Practices

A comprehensive checklist for securing your EKS cluster across all layers.

Security Layers

EKS Security — Defense in Depth
┌───────────────────────────────────────────────────┐
│  Layer 1: AWS Account                             │
│  • IAM least privilege                            │
│  • CloudTrail logging                             │
│  • GuardDuty for EKS                              │
│                                                   │
│  Layer 2: Network                                 │
│  • Private API endpoint                           │
│  • Security groups                                │
│  • Network policies                               │
│                                                   │
│  Layer 3: Cluster                                 │
│  • RBAC (least privilege)                         │
│  • Control plane logging                          │
│  • KMS envelope encryption                        │
│                                                   │
│  Layer 4: Pod                                     │
│  • Pod Security Standards                         │
│  • IRSA (no node-level credentials)               │
│  • Non-root containers                            │
│                                                   │
│  Layer 5: Container                               │
│  • Minimal base images                            │
│  • Image scanning (ECR)                           │
│  • Read-only root filesystem                      │
│  • No privilege escalation                        │
└───────────────────────────────────────────────────┘

Checklist

Network Security

  • Private + public API endpoint (restrict public CIDRs)
  • Network policies enabled and enforced
  • Nodes in private subnets only
  • Security groups: minimal ingress/egress rules

IAM & Authentication

  • IRSA for all pod-to-AWS communication
  • OIDC provider enabled
  • No AWS access keys in pods
  • EKS access entries (not aws-auth ConfigMap)

Cluster Security

  • Control plane logging enabled (audit logs minimum)
  • KMS envelope encryption for Secrets
  • Keep Kubernetes version in standard support
  • Regular RBAC audits

Pod Security

  • Pod Security Standards enforced (baseline minimum)
  • Containers run as non-root
  • No privileged containers (except system pods)
  • Drop all Linux capabilities
  • Read-only root filesystem where possible

Image Security

  • Pull images from ECR (not Docker Hub)
  • Enable ECR image scanning
  • Use specific image tags (not :latest)
  • Sign images with Notation/Cosign

Enable GuardDuty for EKS

$ aws guardduty create-detector --enable \
    --features '[{"Name":"EKS_AUDIT_LOG_MONITORING","Status":"ENABLED"},{"Name":"EKS_RUNTIME_MONITORING","Status":"ENABLED"}]'

GuardDuty analyzes EKS audit logs for:

  • Cryptocurrency mining
  • Unauthorized API calls
  • Privilege escalation attempts
  • Container escape attempts

Common Mistakes

Mistake Impact
cluster-admin for all users No access control
Public API endpoint with 0.0.0.0/0 Anyone can attempt authentication
Running as root Container escape → node compromise
No image scanning Vulnerable base images deployed
No audit logs Can’t investigate security incidents

What’s Next?

Practice: IAM & Security Exercises.

You may also enjoy