Essential EKS Security Best Practices

Understanding EKS security

EKS security refers to the practices, strategies, and technologies that organizations use to protect Amazon Elastic Kubernetes Service (EKS) environments from threats. Encompassing a wide range of measures, from securing the underlying infrastructure to protecting the applications running on EKS, EKS security is vital to safeguarding cloud environments from unauthorized access, data breaches, and other risks. 

Amazon EKS is a managed Kubernetes service provided by AWS that’s designed to facilitate the deployment and management of Kubernetes clusters in the AWS environment. EKS automates crucial tasks such as patch management and cluster scaling. As an integral part of modern cloud infrastructures, EKS offers a highly available and secure environment for containerized applications.

AWS Security Foundations For Dummies

Data, applications, and services- all moving to the cloud. This means you have to take a new approach to protecting your business and customers against cyberattacks. One that keeps up with the speed of the cloud. Learn the most important principles for effective AWS security in this user-friendly book.

Download now

Components of EKS security

Securing an Amazon Elastic Kubernetes Service (EKS) environment involves several key components, each with a critical role in the overall security posture. Understanding these components is the first step toward effectively safeguarding your EKS clusters. Let’s look at the top five components and how they work:

1. Cluster security

Cluster security is the cornerstone of EKS security because it involves securing the Kubernetes control plane managed by AWS and the worker nodes running your applications. Key aspects include:

• Control plane security: AWS manages the control plane's security, but you should configure access control and logging. Additionally, it's important to regularly update the control plane to address any vulnerabilities. Customers can update their control plane with just a click through the AWS management console, ensuring they're always running the latest, most secure version.

• Worker node security: Worker node security involves securing the underlying EC2 instances using Amazon EKS-optimized AMIs and regularly applying patches and updates. Consistent patch management and timely updates are vital ways to protect against emerging threats and vulnerabilities, maintaining the overall security and stability of the cluster.

2. Network security and policies

Network security in EKS is about controlling the communication between pods, nodes, and external networks. It includes:

• Network policies: Define rules to control pod-to-pod communication within the cluster.

• Service mesh implementation: Tools like AWS App Mesh can add a layer of security and control over inter-service communication.

3. Identity access management (IAM)

IAM roles and policies determine who can access the EKS cluster and what actions they can perform. IAM considerations include:

• IAM roles for service accounts (IRSA): IRSA allows Kubernetes service accounts to assume IAM roles, providing fine-grained access control.

• Role-based access control (RBAC): Within Kubernetes, RBAC controls what resources users and services can access within the cluster.

4. Data encryption

Protecting data at rest and in transit is essential. Let’s look at each kind of encryption:

• Encryption at rest: Use AWS Key Management Service (KMS) to encrypt stored data, including EKS volumes.

• Encryption in transit: Ensure that data moving between pods, nodes, and external services is encrypted, typically by using TLS. This ensures that all communication between services are not only encrypted but also authenticated, providing a secure channel for data transfer and protecting against unauthorized access or tampering.

wiz academy

What is Cloud Encryption?

Cloud encryption is the process of transforming data into a secure format that's unreadable to anyone who doesn't have the key to decode it.

Read more

5. Logging and monitoring

Continuous monitoring and logging are essential for identifying and addressing security events effectively. Monitoring and logging tools include:

• CloudWatch logs and metrics: For monitoring cluster performance and security, CloudWatch offers robust logging and easy visualization of metrics.

• Audit logs: Leverage audit logs to track user activities and API calls for compliance and anomaly detection.

By focusing on these components, you can build a robust security framework for your EKS deployments, ensuring that the infrastructure and the applications running on it are well-protected against cyber threats.

wiz blog

Announcing the EKS Cluster Games

Test your investigation skills and K8s knowledge in a new Wiz-sponsored CTF event: the EKS Cluster Games!

Read more

The current threat landscape

Cyber threats are dynamic, and understanding them is key to strengthening the security of your EKS deployments.

Evolving cybersecurity threats in Kubernetes environments

The Kubernetes ecosystem, while robust, is not immune to cybersecurity threats. These threats constantly evolve, with attackers finding new ways to exploit vulnerabilities. Common threats include:

• Container escape: When attackers exploit vulnerabilities to gain control of the host machine

• Misconfigured containers: Containers with default settings or inadequate security configurations

• Resource hijacking: When attackers use compromised containers for crypto-mining or launching further attacks

wiz blog

New attack vectors in EKS

We explore how advancements in EKS Access Entries and Pod Identity have opened new attack vectors and offer examples of how adversaries could exploit them.

Read more

EKS-specific vulnerabilities

EKS deployments have unique vulnerabilities, often stemming from misconfigurations or overlooked security practices. For instance:

• Insecure API server access: Exposing the Kubernetes API server publicly can lead to unauthorized access.

• Improper IAM role configurations: Overly permissive roles can result in privilege escalation.

• Unsecured load balancers: Exposing services without proper security can cause data breaches.

Internal risks and misconfigurations

Insider threats and misconfigurations pose significant risks. Common issues include:

• Poor secrets management: Inadequate secrets management often involves the exposure of sensitive credentials in configuration files and represents a pressing security risk.

• Lack of network segmentation: Without proper network policies, attackers can move laterally across the network with ease.

• Default settings: Default configurations are often insecure, making clusters vulnerable.

The following section will explore nine actionable best practices to mitigate these threats and secure your EKS deployments. We'll cover everything from cluster configuration to disaster recovery planning, so you can take a comprehensive approach to EKS security.

wiz academy

The top 11 open-source Kubernetes security tools

It’s a good idea to consider a range of Kubernetes security tools. Open source solutions can greatly improve the security of your Kubernetes clusters, so this section explores the top 11 open-source Kubernetes security tools that can help to safeguard your Kubernetes environment.

Read more

EKS security best practices

The essential EKS security best practices include:

1. Implement strong cluster configuration

2. Establish advanced network policies

3. Strengthen Access Control

4. Encrypt data at rest and in transit

5. Set up continuous monitoring

6. Utilize multi-tenancy with namespaces and resource quotas

7. Integrate security into CI/CD pipelines

8. Plan for disaster recovery

9. Automate security responses

1. Implement strong cluster configuration

A well-configured cluster is your first line of defense. It’s best practice to set up the cluster with security-focused parameters and keep it updated:

• Use the latest EKS-optimized AMIs: Amazon EKS-optimized AMIs are pre-configured with security enhancements and should be regularly updated to leverage the latest patches.

# Updating EKS Cluster to use the latest AMI
eksctl upgrade cluster --name=your-cluster --approve

• Enable audit logging: Audit logs provide a record of events that can be analyzed for suspicious activities. They are crucial for compliance and security auditing.

# Enabling Audit Logging in EKS
aws eks update-cluster-config \
  --region us-west-2 \
  --name your-cluster \
  --logging '{"clusterLogging":[{"types":["api","audit"],"enabled":true}]}

• Implement pod security policies: These policies control the security specifications a pod must adhere to. They prevent potentially harmful pods from running.

# Example Pod Security Policy
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: stop-privileged-pods
spec:
  privileged: false
  ...

wiz blog

Announcing the K8s LAN Party Challenge

Test your investigation skills and K8s network knowledge in a new CTF event: the K8s LAN Party Challenge!

Read more

2. Establish advanced network policies

Network policies in Kubernetes control the flow of traffic. They are essential for creating a secure, micro-segmented network architecture.

• Implement default deny all ingress and egress: Denying all ingress and egress by default creates a secure baseline. Only the explicitly allowed traffic can flow, reducing the attack surface.

# Default deny-all network policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

• Segment workloads: This process involves isolating different parts of your application into separate network segments, reducing the risk of lateral movement in the case of a breach.

# Workload segmentation policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-segmentation
spec:
  podSelector:
    matchLabels:
      app: database
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: webserver

3. Strengthen access control

In Kubernetes, access control is managed through RBAC. In AWS, IAM is your means of access control. With RBAC and IAM, only authorized users and services can perform specific actions in the cluster.

• Implement RBAC for user and service access: RBAC allows you to define roles and bind them to users or service accounts, providing fine-grained access control.

# RBAC Role and RoleBinding example
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: reader-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

4. Encrypt data at rest and in transit

Encryption is critical for protecting sensitive data. In Kubernetes, this involves encrypting data at rest (stored data) and in transit (data moving between services).

• Use AWS KMS for data at rest: AWS Key Management Service (KMS) integrates with EKS to encrypt stored data, securing it from unauthorized access.

# Creating a KMS key for EKS
aws kms create-key --description "EKS encryption key"

• Enforce TLS for data in transit: Transport Layer Security (TLS) should be enforced for all communications within the cluster to prevent data interception and tampering.

# Enabling TLS in ingress resource
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-example-ingress
spec:
  tls:
  - hosts:
    - example.com
    secretName: example-tls

5. Set up continuous monitoring

Continuous monitoring involves observing the status of and actions in your EKS environment to detect and respond to threats in real time.

• Integrate CloudWatch for cluster monitoring: AWS CloudWatch provides insights into your EKS cluster performance and logs, helping to identify unusual activities that might indicate a security issue.

# Configuring CloudWatch logging for EKS
aws eks update-cluster-config \
  --name your-cluster \
  --region us-west-2 \
  --logging '{"clusterLogging":[{"types":["audit","api"],"enabled":true}]}'

6. Utilize multi-tenancy with namespaces and resource quotas

In a multi-tenant EKS environment, efficiently managing resources and isolating workloads is critical for both security and performance. 

Set up namespaces for workload isolation: Namespaces in Kubernetes act as virtual clusters, allowing you to separate different environments, teams, or projects within the same EKS cluster.

apiVersion: v1
kind: Namespace
metadata:
  name: team-a

• Define resource quotas to manage resource allocation: By implementing resource quotas, you can control the amount of resources (like CPU and memory) that each namespace or tenant can consume, preventing any single tenant from monopolizing cluster resources and affecting others.

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "6"
    limits.memory: 16Gi

7. Integrate security into CI/CD pipelines

Incorporating security into CI/CD pipelines ensures that security checks are automated and integrated into the development process, reducing the risk of deploying vulnerable applications.

# CI/CD pipeline steps for vulnerability scanning:
- name: vulnerability-scan
  image: aquasec/trivy:latest
  commands:
  - trivy filesystem --exit-code 1 --no-progress

8. Plan for disaster recovery

Disaster recovery planning is about preparing for and quickly recovering from incidents that cause significant service disruptions. Be sure to plan for data loss, major outages, and other catastrophic events.

# Backup EKS cluster using Velero
velero backup create <BACKUP-NAME> --include-namespaces <NAMESPACE> 

9. Automate security responses

Automating security responses helps to address vulnerabilities and threats quickly, reducing the time attackers have to exploit weaknesses.

# Automating EKS node updates
eksctl upgrade nodegroup --name=standard-workers --cluster=my-cluster

Kubernetes Security Best Practices [Cheat Sheet]

This 6 page cheat sheet goes beyond the basics and cover security best practices for Kubernetes pods, components, and network security.

Download PDF

Advanced security techniques and emerging trends in EKS

As the EKS environment continues to evolve, it’s imperative to stay ahead of the curve. This section explores advanced security techniques and the latest trends in the field of Kubernetes security.

Embracing zero-trust architecture

Zero trust is a security model that requires each user and each device to undergo identity verification, no matter if they are inside or outside of the network perimeter. Implementing zero trust in EKS involves:

• Micro-segmentation of networks

• Enforcing mTLS for secure communication

• Implementing least-privilege access

• Continuous authentication and authorization

Advanced threat detection

In order to identify and mitigate security risks effectively, it’s crucial to incorporate advanced threat detection in EKS environments. This involves:

• Correlating multiple signals and utilizing cloud event logs and real-time runtime events to identify suspicious activities

• Promptly alerting to ensure immediate notification upon detection of potential threats

• Employing sophisticated methods to pinpoint and address security concerns accurately

Container security best practices

As containers form the backbone of EKS, ensuring their security is paramount. Security measures include:

• Regular vulnerability scanning of container images

• Adding guardrails with admission controllers to stop vulnerable images from being deployed

• Using container signing to ensure integrity

• Implementing runtime security for active threat detection

• Avoiding root or high privileges in the container level and blocking deployment in the case of non-compliance

wiz academy

What is Container Security?

Container security is the process of securing the container pipeline, the content running inside the containers, and the infrastructure on which the containers run.

Read more

Advanced secrets management

Effective secrets management is another critical component of Kubernetes security, particularly in EKS environments. Advanced secrets management strategies, like those listed below, go beyond basic ETCD encryption, ensuring that sensitive information like credentials and API keys are securely managed and accessed:

• Integration with external secrets managers 

• Access control for secrets 

• Automated secrets rotation

• Audit trails for secrets access

• Encrypted secrets transmission

Compliance and governance

It goes without saying that staying compliant with industry standards and regulations is key. Compliance and governance involves:

• Regular compliance audits

• Automated policy enforcement

• Governance, risk, and compliance (GRC) tools

Responding to emerging threats

Here are a few practices for staying informed about the latest types of attacks and vulnerabilities:

• Subscribing to security bulletins and threat intelligence feeds

• Regular security training for staff

• Participating in community forums and discussions

Container Security Best Practices [Cheat Sheet]

This cheat sheet goes beyond the no-brainer container security best practices and explores advanced techniques that you can put into action ASAP.

Download PDF

Conclusion

To bridge the gap between evolving security needs and effective solutions, Wiz offers a comprehensive suite of tools tailored for Kubernetes and EKS environments. To see these features in action and understand how Wiz can further secure your EKS deployments, request a demo. Experience firsthand how Wiz can enhance your cloud security strategy and help you maintain a robust defense in the dynamic world of cloud computing.

Other security best practices you might be interested in:

• AKS Security Best Practices

• 10 Essential AWS Security Best Practices

• 5 Azure Security Best Practices

• 8 Cloud Security Best Practices

• 10 Google Cloud Security Best Practices

• 8 No-brainer Container Security Best Practices

• 11 Vulnerability Management Best Practices

• 7 S3 Security Best Practices

• 11 API Security Best Practices

• 6 CI/CD Pipeline Security Best Practices

• 20 Security Best Practices for DevOps