EKS Clusters Encryption Of Secrets Should Be Enabled

More Info:

This rule checks if Amazon Elastic Kubernetes Service (EKS) clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys. It is marked as COMPLIANT if an EKS cluster has an encryptionConfig with secrets as one of the resources. It is also marked as COMPLIANT if the key used to encrypt EKS secrets matches with the parameter. It is marked as NON_COMPLIANT if an EKS cluster does not have an encryptionConfig or if the encryptionConfig resources do not include secrets. Additionally, it is marked as NON_COMPLIANT if the key used to encrypt EKS secrets does not match with the parameter.

Risk Level

Medium

Address

Security

Compliance Standards

CISEKS,SEBI

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of EKS Clusters Encryption of Secrets not being enabled in AWS Kubernetes using AWS CLI, you can follow these steps:

Enable Encryption of Secrets in the EKS Cluster:
- Open the AWS Management Console and navigate to the Amazon EKS console.
- Select your EKS cluster that needs to be remediated.
- Click on the “Configuration” tab.
- Under the “Security” section, click on the “Edit” button.
- Enable the “Encryption Config” option.
- Click on the “Save” button to apply the changes.
Update the AWS CLI Configuration:
- Open your terminal and configure the AWS CLI with the necessary permissions to make changes to the EKS cluster.
- Run the following AWS CLI command to update the encryption configuration for the EKS cluster:
  aws eks update-cluster-config --name <cluster-name> --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=true,publicAccessCidrs=<CIDR-block> --encryption-config provider=aws/kms,keyARN=<KMS-key-ARN>
  Replace <cluster-name> with the name of your EKS cluster, <CIDR-block> with the CIDR block for public access, and <KMS-key-ARN> with the ARN of the KMS key to use for encryption.
Verify the Encryption Configuration:
- Run the following AWS CLI command to describe the cluster and verify that encryption of secrets is enabled:
  aws eks describe-cluster --name <cluster-name> --query cluster.encryptionConfig
  Replace <cluster-name> with the name of your EKS cluster.
Monitor the EKS Cluster:
- Monitor the EKS cluster to ensure that the encryption of secrets is successfully enabled and functioning as expected.
- Check for any errors or warnings in the EKS cluster logs related to encryption of secrets.

By following these steps, you can remediate the misconfiguration of EKS Clusters Encryption of Secrets not being enabled in AWS Kubernetes using AWS CLI.

Using Python

To remediate the misconfiguration of EKS Clusters Encryption of Secrets not being enabled in AWS Kubernetes, you can follow these steps using Python:

Import the necessary libraries:

import boto3

Create a boto3 client for EKS:

eks_client = boto3.client('eks')

Retrieve the list of EKS clusters:

clusters = eks_client.list_clusters()

Iterate through the list of clusters and enable encryption of secrets for each cluster:

for cluster_name in clusters['clusters']:
    response = eks_client.update_cluster_config(
        name=cluster_name,
        resourcesVpcConfig={
            'endpointPublicAccess': False,
            'endpointPrivateAccess': True
        }
    )
    print(f"Encryption of secrets enabled for cluster: {cluster_name}")

Run the Python script to enable encryption of secrets for all EKS clusters in your AWS account.

By following these steps, you can remediate the misconfiguration of EKS Clusters Encryption of Secrets not being enabled in AWS Kubernetes using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EKS Clusters Encryption Of Secrets Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation