~/ nmadiraju.com Amazon EKS · CIS benchmarks and compliance
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How CIS Benchmarks and Compliance Work on Amazon EKS

Follow an auditor's question about shop-prod, section by section, then check yourself with 8 questions.

1Visual Walkthrough

The CIS Amazon EKS Benchmark's sections checked against EKS cluster shop-prod Left, the auditor, the counter and you. Next, the five sections of the CIS Amazon EKS Benchmark as kube-bench's eks-1.8.0 profile encodes them. Centre, EKS cluster shop-prod with the AWS-managed control plane, cluster policy objects, managed node group ng-shop with its launch template, three AL2023 nodes and a kube-bench Job, and an Auto Mode Bottlerocket node. Right, Security Hub CSPM and AWS Config in the AWS account, and an exceptions register. The walkthrough shows the shared responsibility split, a kube-bench node FAIL fixed by hand and then in the launch template, a cluster-admin FAIL fixed with RBAC, add-on FAILs kept as exceptions and other policy items mapped to evidence, the Bottlerocket CIS report, weekly scans into Security Hub and an accepted exception. Auditor asks about shop-prod You · platform kubectl · AWS console CIS EKS · kube-bench eks-1.8.0 1 Control plane components · AWS runs 2 Control plane config audit logs · yours 3 Worker nodes kubelet, files · yours 4 Policies RBAC, PSS, CNI, Secrets 5 Managed services ECR, IAM, KMS, endpoint EKS CLUSTER shop-prod · KUBERNETES 1.34 · us-east-1 EKS control plane · AWS-managed Cluster policy objects MANAGED NODE GROUP ng-shop · AL2023 Launch template lt-shop · NodeConfig ip-10-0-12-34 ip-10-0-31-77 ip-10-0-45-90 Auto Mode node i-0b7c41e2a9d3f5e18 · Bottlerocket AWS ACCOUNT · us-east-1 Security Hub CSPM AWS Config rules EKS.1 public endpoint EKS.8 audit logging Exceptions register

    2Quiz to check understanding

    Check yourself