CIS Envoy Proxy Benchmark

This recommendation verifies that Envoy runs as a non-root user on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Envoy runs as non-root
ps -eo user,pid,comm | grep envoy
grep -E '^User|^Group' /etc/envoy/envoy.yaml

# Configure Envoy to run as non-root user
useradd -r -s /usr/sbin/nologin envoy
chown -R envoy:envoy /etc/envoy /var/log/envoy
# Update systemd unit: User=envoy, Group=envoy

This setting ensures that configuration file permissions are restricted on the Envoy Proxy service mesh proxy. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Envoy Proxy service mesh proxy is essential for defense in depth.

# Check file permissions on Envoy configuration
stat -c '%a %U %G' /etc/envoy/envoy.yaml
find /etc/envoy -type f -exec stat -c '%a %n' {} \;

# Restrict configuration file permissions
chmod 640 /etc/envoy/envoy.yaml
chown root:envoy /etc/envoy/envoy.yaml
chmod 750 /etc/envoy/

This recommendation verifies that TLS 1.3 is configured on all listeners on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify TLS is configured on all listeners
grep -A 20 'transport_socket' /etc/envoy/envoy.yaml | grep -E 'tls_minimum|tls_certificates'

# Configure TLS on listeners
# In listener config:
#   transport_socket:
#     name: envoy.transport_sockets.tls
#     typed_config:
#       '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
#       common_tls_context:
#         tls_params:
#           tls_minimum_protocol_version: TLSv1_3

This recommendation ensures that mutual TLS is enforced on upstream connections on the Envoy Proxy service mesh proxy. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Envoy Proxy service mesh proxy may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify mTLS is enforced on upstream connections
grep -A 15 'transport_socket' /etc/envoy/envoy.yaml | grep 'require_client_certificate'

# Enable mutual TLS
# In DownstreamTlsContext:
#   require_client_certificate: true
#   common_tls_context:
#     validation_context:
#       trusted_ca:
#         filename: /etc/envoy/certs/ca.pem

This recommendation verifies that admin interface is bound to localhost only on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check admin interface binding
grep -A 10 'admin:' /etc/envoy/envoy.yaml | grep 'address\|port_value'

# Bind admin interface to localhost only
# admin:
#   address:
#     socket_address:
#       address: 127.0.0.1
#       port_value: 9901

This recommendation verifies that access logging is enabled on all listeners on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify access logging is enabled
grep -A 10 'access_log' /etc/envoy/envoy.yaml | head -20

# Enable access logging on all listeners
# In http_connection_manager:
#   access_log:
#     - name: envoy.access_loggers.file
#       typed_config:
#         '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
#         path: /var/log/envoy/access.log

This recommendation verifies that rate limiting is configured on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting configuration
grep -rn 'rate_limit\|local_rate_limit' /etc/envoy/envoy.yaml

# Configure rate limiting filter
# In http_filters:
#   - name: envoy.filters.http.local_ratelimit
#     typed_config:
#       '@type': type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
#       stat_prefix: http_local_rate_limiter
#       token_bucket:
#         max_tokens: 100
#         tokens_per_fill: 100
#         fill_interval: 60s

This recommendation verifies that connection limits and circuit breakers are set on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify connection limits are set
grep -E 'max_connections|max_pending_requests|max_requests' /etc/envoy/envoy.yaml

# Set circuit breaker thresholds
# In cluster config:
#   circuit_breakers:
#     thresholds:
#       - priority: DEFAULT
#         max_connections: 1024
#         max_pending_requests: 1024
#         max_requests: 1024

This setting ensures that CORS policy is restricted to trusted origins on the Envoy Proxy service mesh proxy. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Envoy Proxy service mesh proxy is essential for defense in depth.

# Verify CORS policy is configured
grep -A 10 'cors' /etc/envoy/envoy.yaml

# Configure CORS policy
# In route_config:
#   virtual_hosts:
#     - cors:
#         allow_origin_string_match:
#           - exact: 'https://trusted.example.com'
#         allow_methods: GET, POST
#         allow_headers: content-type
#         max_age: '600'

This recommendation verifies that security response headers are injected on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check header manipulation for security headers
grep -A 5 'response_headers_to_add' /etc/envoy/envoy.yaml

# Add security response headers
# In route_config or virtual_host:
#   response_headers_to_add:
#     - header:
#         key: X-Content-Type-Options
#         value: nosniff
#     - header:
#         key: X-Frame-Options
#         value: DENY
#     - header:
#         key: Strict-Transport-Security
#         value: max-age=31536000; includeSubDomains

This recommendation verifies that health checks are configured on all clusters on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify health check configuration
grep -A 10 'health_checks' /etc/envoy/envoy.yaml

# Configure health checks on clusters
# In cluster config:
#   health_checks:
#     - timeout: 5s
#       interval: 10s
#       unhealthy_threshold: 3
#       healthy_threshold: 2
#       http_health_check:
#         path: /healthz

This recommendation verifies that outlier detection is enabled on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check outlier detection settings
grep -A 10 'outlier_detection' /etc/envoy/envoy.yaml

# Configure outlier detection
# In cluster config:
#   outlier_detection:
#     consecutive_5xx: 5
#     interval: 10s
#     base_ejection_time: 30s
#     max_ejection_percent: 50

This recommendation verifies that Envoy is running the latest stable version on the Envoy Proxy service mesh proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Envoy Proxy service mesh proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Envoy is running the latest stable version
envoy --version
curl -s https://api.github.com/repos/envoyproxy/envoy/releases/latest | grep tag_name

# Update Envoy to latest stable version
# Download from official releases:
# https://www.envoyproxy.io/docs/envoy/latest/start/install
apt-get update && apt-get install --only-upgrade envoy

This recommendation verifies that debug logging is disabled in production on the Envoy Proxy service mesh proxy. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Envoy Proxy service mesh proxy increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check if debug logging is disabled in production
grep -E 'log_level|log_path' /etc/envoy/envoy.yaml
grep 'component_log_level' /etc/envoy/envoy.yaml

# Set production log level
# In bootstrap config:
# Or via admin API:
curl -X POST 'http://localhost:9901/logging?level=warning'