Security Groups for Pods
Because pods have real VPC IPs, you can attach EC2 security groups directly to individual pods.
A powerful side effect of the VPC CNI is security groups for pods. You can apply an EC2 security group to specific pods, giving them fine-grained, identity-aware network rules independent of the node.
How it works
You create a SecurityGroupPolicy custom resource that maps a pod selector to one or more security group IDs. Matching pods get a dedicated branch ENI carrying those rules.
Typical use case
Lock down a pod so it can reach an RDS database (whose security group only allows that pod's group) while other pods on the same node cannot.
Example
apiVersion: vpcresources.k8s.aws/v1beta1
kind: SecurityGroupPolicy
metadata:
name: db-access
namespace: prod
spec:
podSelector:
matchLabels:
app: payments
securityGroups:
groupIds:
- sg-0123456789abcdef0When to use it
- A database team restricts RDS access to pods running the API service by placing both in a shared security group, eliminating broad node-level ingress rules.
- A compliance team proves to auditors that only the payment-processor pods can reach the PCI-scoped subnet, enforced via pod-level security groups.
- An SRE team uses security groups for pods to apply different inbound rules to the web tier and the internal admin tier running on the same nodes.
More examples
Create SecurityGroupPolicy resource
Attaches an EC2 security group to all pods labeled app=api, enforcing VPC-level network rules at the pod rather than the node.
apiVersion: vpcresources.k8s.aws/v1beta1
kind: SecurityGroupPolicy
metadata:
name: api-sgp
namespace: default
spec:
podSelector:
matchLabels:
app: api
securityGroups:
groupIds:
- sg-0abc123456789def0Enable security groups for pods
Enables the pod ENI feature in the VPC CNI, which is required before SecurityGroupPolicy resources take effect.
kubectl set env daemonset aws-node \
-n kube-system \
ENABLE_POD_ENI=true
kubectl rollout status daemonset/aws-node -n kube-systemVerify pod has its own ENI
Confirms the pod has a dedicated branch ENI and lists the security groups attached directly to it at the VPC layer.
POD_IP=$(kubectl get pod api-pod -o jsonpath='{.status.podIP}')
aws ec2 describe-network-interfaces \
--filters Name=private-ip-address,Values=$POD_IP \
--query 'NetworkInterfaces[*].{ID:NetworkInterfaceId,SGs:Groups[*].GroupId}'
Discussion