Security Best Practices
Layered defenses — private endpoints, IRSA, encryption, and least-privilege RBAC — keep EKS clusters safe.
Securing EKS means hardening several layers, not flipping one switch. Apply these together.
Cluster access
- Make the API endpoint private (or restrict the public CIDR list) so it isn't open to the whole internet.
- Use access entries and least-privilege RBAC; never share the cluster-creator admin identity.
Workload identity & secrets
- Give pods AWS access only through IRSA, never node-wide credentials.
- Enable envelope encryption of Kubernetes secrets with a KMS key.
Network & images
- Apply NetworkPolicies and security groups for pods to limit east-west traffic.
- Scan images in ECR and only run trusted, patched images.
Stay current
Upgrade the cluster and node AMIs regularly — running an unsupported version is a security risk.
Example
# Restrict the public endpoint to your office CIDR and enable private access
aws eks update-cluster-config \
--name demo \
--resources-vpc-config \
endpointPublicAccess=true,publicAccessCidrs="203.0.113.0/24",endpointPrivateAccess=true
# Turn on control-plane audit logging
aws eks update-cluster-config --name demo \
--logging '{"clusterLogging":[{"types":["audit","authenticator"],"enabled":true}]}'When to use it
- A security team enables private endpoint access and removes public access on production clusters so the API server is only reachable from within the VPC.
- A compliance team enforces envelope encryption on etcd by enabling KMS key encryption on the EKS cluster to protect Secrets at rest.
- A DevSecOps team runs kube-bench against their EKS nodes regularly to detect drift from CIS Kubernetes Benchmark recommendations.
More examples
Enable envelope encryption with KMS
Enables KMS envelope encryption for Kubernetes Secrets stored in etcd, adding an extra layer of protection for sensitive data.
aws eks associate-encryption-config \
--cluster-name prod \
--encryption-config '[{
"resources":["secrets"],
"provider":{"keyArn":"arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"}
}]'Enable private-only API endpoint
Removes public API access and restricts the Kubernetes API server to the VPC network only, significantly reducing the attack surface.
aws eks update-cluster-config \
--name prod \
--resources-vpc-config \
endpointPublicAccess=false,\
endpointPrivateAccess=true,\
publicAccessCidrs=[]Default-deny NetworkPolicy
A catch-all NetworkPolicy that denies all ingress and egress for every pod in the namespace, forcing explicit allow policies per workload.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
Discussion