Amazon EKS — Security

EKS security spans two domains: AWS IAM and Kubernetes RBAC. This chapter covers identity, access control, secrets management, pod security policies, and runtime protection.

---

Topics Covered

#	Topic	Description
1	IAM & RBAC	AWS IAM + Kubernetes RBAC integration
2	IRSA	IAM Roles for Service Accounts
3	EKS Pod Identity	Simplified pod-level AWS access
4	EKS Access Entries	Modern cluster access management
5	Secrets Management	KMS, Secrets Manager, and ESO
6	Pod Security & Policy Engines	PSS, Gatekeeper, Kyverno, GuardDuty
7	Hands-On Lab	Configure IRSA, RBAC, and pod security
8	Practice Questions	Test your EKS security knowledge

---

EKS Security Model

Layer	AWS Responsibility	Your Responsibility
Control plane	API server, etcd, scheduler	RBAC, access entries, audit logging
Data plane (nodes)	AMI updates (managed nodes)	Security groups, OS patching (self-managed)
Pod-level	—	IRSA/Pod Identity, PSS, secrets encryption
Network	VPC infrastructure	Security groups, network policies, private endpoints
Compliance	SOC, ISO, PCI infrastructure	Application-level compliance, encryption

---

Start Learning →