CIS Amazon EKS Benchmark

This recommendation verifies that EKS Cluster Is Running a Supported Version on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that EKS Cluster Is Running a Supported Version. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure EKS Cluster Is Running a Supported Version. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that EKS Platform Version Is Current on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that EKS Platform Version Is Current. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure EKS Platform Version Is Current. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Kubernetes Secrets Are Encrypted with KMS on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Kubernetes Secrets Are Encrypted with KMS. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Kubernetes Secrets Are Encrypted with KMS. Apply changes via eksctl, AWS CLI, or the EKS console.

This setting ensures that Cluster Endpoint Public Access Is Restricted on the Amazon EKS managed Kubernetes service. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon EKS managed Kubernetes service is essential for defense in depth.

Run aws eks describe-cluster or kubectl commands to verify that Cluster Endpoint Public Access Is Restricted. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Cluster Endpoint Public Access Is Restricted. Apply changes via eksctl, AWS CLI, or the EKS console.

This setting ensures that API Server Endpoint Is Private or Restricted on the Amazon EKS managed Kubernetes service. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon EKS managed Kubernetes service is essential for defense in depth.

Run aws eks describe-cluster or kubectl commands to verify that API Server Endpoint Is Private or Restricted. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure API Server Endpoint Is Private or Restricted. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Authorized IP Ranges Are Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Authorized IP Ranges Are Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Authorized IP Ranges Are Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that OIDC Identity Provider Is Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that OIDC Identity Provider Is Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure OIDC Identity Provider Is Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Managed Node Groups Are Used on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Managed Node Groups Are Used. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Managed Node Groups Are Used. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Node AMI Is Hardened on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Node AMI Is Hardened. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Node AMI Is Hardened. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that kubelet Configuration Is Secure on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that kubelet Configuration Is Secure. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure kubelet Configuration Is Secure. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Node Labels Are Not Exposing Sensitive Info on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Node Labels Are Not Exposing Sensitive Info. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Node Labels Are Not Exposing Sensitive Info. Apply changes via eksctl, AWS CLI, or the EKS console.

This setting ensures that SSH Access to Nodes Is Restricted on the Amazon EKS managed Kubernetes service. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon EKS managed Kubernetes service is essential for defense in depth.

Run aws eks describe-cluster or kubectl commands to verify that SSH Access to Nodes Is Restricted. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure SSH Access to Nodes Is Restricted. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation ensures that Instance Metadata Service v2 Is Required on the Amazon EKS managed Kubernetes service. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Amazon EKS managed Kubernetes service may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Run aws eks describe-cluster or kubectl commands to verify that Instance Metadata Service v2 Is Required. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Instance Metadata Service v2 Is Required. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Node Security Groups Are Restrictive on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Node Security Groups Are Restrictive. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Node Security Groups Are Restrictive. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Fargate Profiles Are Used Where Appropriate on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Fargate Profiles Are Used Where Appropriate. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Fargate Profiles Are Used Where Appropriate. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Network Policies Are Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Network Policies Are Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Network Policies Are Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Default Deny Network Policy Exists on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Default Deny Network Policy Exists. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Default Deny Network Policy Exists. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that CNI Plugin Supports Network Policies on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that CNI Plugin Supports Network Policies. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure CNI Plugin Supports Network Policies. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Service Accounts Do Not Use Default Tokens on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Service Accounts Do Not Use Default Tokens. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Service Accounts Do Not Use Default Tokens. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that LoadBalancer Services Use Security Groups on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that LoadBalancer Services Use Security Groups. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure LoadBalancer Services Use Security Groups. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Ingress Controller Is Properly Secured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Ingress Controller Is Properly Secured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Ingress Controller Is Properly Secured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Pod-to-Pod Communication Is Encrypted on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Pod-to-Pod Communication Is Encrypted. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Pod-to-Pod Communication Is Encrypted. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that IAM Roles for Service Accounts Are Used on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that IAM Roles for Service Accounts Are Used. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure IAM Roles for Service Accounts Are Used. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Cluster Role Is Minimal on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Cluster Role Is Minimal. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Cluster Role Is Minimal. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that aws-auth ConfigMap Is Properly Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that aws-auth ConfigMap Is Properly Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure aws-auth ConfigMap Is Properly Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Pod Identity Agent Is Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Pod Identity Agent Is Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Pod Identity Agent Is Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that RBAC Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that RBAC Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure RBAC Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This setting ensures that Cluster-Admin Role Is Restricted on the Amazon EKS managed Kubernetes service. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon EKS managed Kubernetes service is essential for defense in depth.

Run aws eks describe-cluster or kubectl commands to verify that Cluster-Admin Role Is Restricted. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Cluster-Admin Role Is Restricted. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Service Accounts Have Minimal Permissions on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Service Accounts Have Minimal Permissions. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Service Accounts Have Minimal Permissions. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that API Server Audit Logging Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that API Server Audit Logging Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure API Server Audit Logging Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Authenticator Logging Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Authenticator Logging Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Authenticator Logging Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Controller Manager Logging Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Controller Manager Logging Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Controller Manager Logging Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Scheduler Logging Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Scheduler Logging Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Scheduler Logging Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that CloudWatch Container Insights Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that CloudWatch Container Insights Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure CloudWatch Container Insights Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that GuardDuty EKS Protection Is Enabled on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that GuardDuty EKS Protection Is Enabled. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure GuardDuty EKS Protection Is Enabled. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Prometheus or Equivalent Monitoring Is Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Prometheus or Equivalent Monitoring Is Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Prometheus or Equivalent Monitoring Is Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Pod Security Admission Is Configured on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Pod Security Admission Is Configured. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Pod Security Admission Is Configured. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Privileged Containers Are Not Used on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Privileged Containers Are Not Used. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Privileged Containers Are Not Used. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Containers Run as Non-Root on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Containers Run as Non-Root. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Containers Run as Non-Root. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Read-Only Root Filesystem Is Used on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Read-Only Root Filesystem Is Used. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Read-Only Root Filesystem Is Used. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Container Images Are from Trusted Registries on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Container Images Are from Trusted Registries. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Container Images Are from Trusted Registries. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Image Scanning Is Enabled in ECR on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Image Scanning Is Enabled in ECR. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Image Scanning Is Enabled in ECR. Apply changes via eksctl, AWS CLI, or the EKS console.

This recommendation verifies that Images Are Signed and Verified on the Amazon EKS managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon EKS managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run aws eks describe-cluster or kubectl commands to verify that Images Are Signed and Verified. Review the EKS console for confirmation.

Update the EKS cluster configuration to ensure Images Are Signed and Verified. Apply changes via eksctl, AWS CLI, or the EKS console.