Skip to content
This repository was archived by the owner on Jun 6, 2025. It is now read-only.

Commit 136bcc3

Browse files
tas50tas50
committed
Add checks for EKS to the AWS policy
Now that we scan EKS clusters as assets we should have at least a few checks for the clusters Signed-off-by: Tim Smith <tsmith84@gmail.com>
1 parent 5de3da0 commit 136bcc3

1 file changed

Lines changed: 217 additions & 0 deletions

File tree

‎core/mondoo-aws-security.mql.yaml‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,8 +116,225 @@ policies:
116116
checks:
117117
- uid: mondoo-aws-security-cloud-trail-encryption-enabled
118118
- uid: mondoo-aws-security-cloud-trail-log-file-validation-enabled
119+
- title: AWS EKS Cluster
120+
checks:
121+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms
122+
- uid: mondoo-aws-security-eks-cluster-private-controlplane
119123
scoring_system: highest impact
120124
queries:
125+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms
126+
impact: 70
127+
title: Ensure Amazon EKS clusters are configured to use AWS Key Management Service (KMS) for encryption of Kubernetes secrets
128+
variants:
129+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-api
130+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-hcl
131+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-plan
132+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-state
133+
docs:
134+
desc: |
135+
This check ensures that Amazon EKS clusters are configured to use AWS Key Management Service (KMS) for encryption of Kubernetes secrets. By default, EKS uses a default KMS key for encryption, but organizations can create and manage their own customer-managed keys (CMKs) for enhanced security and compliance.
136+
137+
**Why this matters**
138+
139+
Using KMS for encryption provides several benefits:
140+
141+
- **Data protection:** Secrets are encrypted at rest using strong encryption algorithms.
142+
- **Access control:** Organizations can manage access to the KMS key using IAM policies.
143+
- **Auditability:** AWS CloudTrail logs all KMS key usage, providing a detailed audit trail.
144+
145+
**Risk mitigation:**
146+
147+
- **Prevents unauthorized access:** Only authorized users and services can decrypt secrets.
148+
- **Ensures compliance:** Meets regulatory requirements for data protection and encryption.
149+
- **Enhances security posture:** Reduces the risk of data breaches and unauthorized access to sensitive information.
150+
remediation:
151+
- id: console
152+
desc: |
153+
**Using AWS Console**
154+
155+
1. Navigate to the Amazon EKS Console.
156+
2. Select the EKS cluster you want to configure.
157+
3. In the Configuration tab, select Secrets Encryption.
158+
4. Choose the option to use a custom KMS key.
159+
5. Select or create a new KMS key for encryption.
160+
6. Save the changes to apply the new configuration.
161+
- id: cli
162+
desc: |
163+
**Using AWS CLI**
164+
165+
To check if your EKS cluster is using a custom KMS key:
166+
167+
```bash
168+
aws eks describe-cluster --name <cluster_name> --query "cluster.encryptionConfig"
169+
```
170+
171+
If no custom KMS key is listed, you can update the cluster configuration:
172+
173+
```bash
174+
aws eks update-cluster-config --name <cluster_name> --resources-vpc-config <vpc_config> --encryption-config <kms_key_arn>
175+
```
176+
- id: terraform
177+
desc: |
178+
**Using Terraform**
179+
180+
Define an EKS cluster with a custom KMS key in your Terraform configuration:
181+
182+
```hcl
183+
resource "aws_eks_cluster" "example" {
184+
name = "example-cluster"
185+
role_arn = aws_iam_role.eks_role.arn
186+
187+
vpc_config {
188+
subnet_ids = [aws_subnet.eks_subnet.id]
189+
}
190+
}
191+
```
192+
- id: cloudformation
193+
desc: |
194+
**Using CloudFormation**
195+
196+
Create an EKS cluster with a custom KMS key in your CloudFormation template:
197+
198+
```yaml
199+
Resources:
200+
MyEKSCluster:
201+
Type: AWS::EKS::Cluster
202+
Properties:
203+
Name: example-cluster
204+
RoleArn: !GetAtt eksRole.Arn
205+
VpcConfig:
206+
SubnetIds:
207+
- !Ref eksSubnet
208+
EncryptionConfig:
209+
- Provider:
210+
KeyArn: !Ref myKmsKey
211+
Resources:
212+
- "*"
213+
```
214+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-api
215+
filters: asset.platform == "aws"
216+
mql: |
217+
aws.eks.cluster.encryptionConfig != empty
218+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-hcl
219+
filters: asset.platform == "terraform-hcl"
220+
mql: |
221+
TODO
222+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-plan
223+
filters: asset.platform == "terraform-plan"
224+
mql: |
225+
eksPlan = terraform.plan.resourceChanges.where(type == "aws_eks_cluster").map(change.after.encryption_config).first
226+
eksPlan.contains('provider') && eksPlan.contains('key_arn') && eksPlan.contains(props.mondooAWSSecurityEksClusterCmksInKms)
227+
- uid: mondoo-aws-security-eks-cluster-cmks-in-kms-terraform-state
228+
filters: asset.platform == "terraform-state"
229+
mql: |
230+
TODO
231+
- uid: mondoo-aws-security-eks-cluster-private-controlplane
232+
impact: 100
233+
title: Ensure Amazon EKS clusters are configured with private endpoint access
234+
variants:
235+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-api
236+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-hcl
237+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-plan
238+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-state
239+
docs:
240+
desc: |
241+
This check ensures that Amazon EKS clusters are configured with private endpoint access. By default, EKS clusters are accessible over the public internet, which can expose them to potential attacks. Configuring private endpoint access restricts access to the cluster's API server to resources within the VPC.
242+
243+
**Why this matters**
244+
245+
- **Security:** Reduces the attack surface by preventing public access to the EKS control plane.
246+
- **Compliance:** Meets security standards and best practices for cloud-native applications.
247+
- **Network isolation:** Enhances network security by limiting access to trusted networks.
248+
249+
**Risk mitigation:**
250+
251+
- **Prevents unauthorized access:** Only resources within the VPC can communicate with the EKS control plane.
252+
- **Enhances security posture:** Reduces the risk of data breaches and unauthorized access to sensitive information.
253+
- **Improves compliance:** Aligns with security frameworks and regulations that require network isolation.
254+
remediation:
255+
- id: console
256+
desc: |
257+
**Using AWS Console**
258+
259+
1. Navigate to the Amazon EKS Console.
260+
2. Select the EKS cluster you want to configure.
261+
3. In the Configuration tab, select Networking.
262+
4. Under Cluster Endpoint Access, choose Private.
263+
5. Save the changes to apply the new configuration.
264+
- id: cli
265+
desc: |
266+
**Using AWS CLI**
267+
268+
To check if your EKS cluster is using private endpoint access:
269+
270+
```bash
271+
aws eks describe-cluster --name <cluster_name> --query "cluster.resourcesVpcConfig.endpointPrivateAccess"
272+
```
273+
274+
If the output is false, you can update the cluster configuration:
275+
276+
```bash
277+
aws eks update-cluster-config --name <cluster_name> --resources-vpc-config endpointPrivateAccess=true
278+
```
279+
- id: terraform
280+
desc: |
281+
**Using Terraform**
282+
283+
Define an EKS cluster with private endpoint access in your Terraform configuration:
284+
285+
```hcl
286+
resource "aws_eks_cluster" "example" {
287+
name = "example-cluster"
288+
role_arn = aws_iam_role.eks_role.arn
289+
290+
vpc_config {
291+
subnet_ids = [aws_subnet.eks_subnet.id]
292+
endpoint_private_access = true
293+
}
294+
}
295+
```
296+
- id: cloudformation
297+
desc: |
298+
**Using CloudFormation**
299+
300+
Create an EKS cluster with private endpoint access in your CloudFormation template:
301+
302+
```yaml
303+
Resources:
304+
MyEKSCluster:
305+
Type: AWS::EKS::Cluster
306+
Properties:
307+
Name: example-cluster
308+
RoleArn: !GetAtt eksRole.Arn
309+
VpcConfig:
310+
SubnetIds:
311+
- !Ref eksSubnet
312+
EndpointPrivateAccess: true
313+
EndpointPublicAccess: false
314+
```
315+
refs:
316+
- url: https://docs.aws.amazon.com/eks/latest/userguide/pod-networking.html
317+
title: Amazon EKS - Pod networking
318+
- url: https://docs.aws.amazon.com/eks/latest/userguide/networking-vpc.html
319+
title: Amazon EKS - Networking in Amazon VPC
320+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-api
321+
filters: asset.platform == "aws"
322+
mql: |
323+
aws.eks.cluster.resourcesVpcConfig.endpointPrivateAccess == true
324+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-hcl
325+
filters: asset.platform == "terraform-hcl"
326+
mql: |
327+
terraform.resources.where(nameLabel == "aws_eks_cluster").any(arguments.vpc_config.any(endpointPrivateAccess == true))
328+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-plan
329+
filters: asset.platform == "terraform-plan"
330+
mql: |
331+
eksPlan = terraform.plan.resourceChanges.where(type == "aws_eks_cluster").map(change.after.vpc_config).first
332+
eksPlan.contains('endpoint_private_access') && eksPlan.contains(true)
333+
- uid: mondoo-aws-security-eks-cluster-private-controlplane-terraform-state
334+
filters: asset.platform == "terraform-state"
335+
mql: |
336+
eksState = terraform.state.resources.where(type == "aws_eks_cluster").map(values.vpc_config).first
337+
eksState.contains('endpoint_private_access') && eksState.contains(true)
121338
- uid: mondoo-aws-security-iam-root-access-key-check
122339
title: Ensure no root user account access key exists
123340
impact: 85

0 commit comments

Comments
 (0)