~/ nmadiraju.com Amazon EKS · Runtime and image security
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Runtime and Image Security Work on Amazon EKS

Follow the checkout image from CI to running Pods, and an attacker who later gets in, then check yourself with 8 questions.

1Visual Walkthrough

The checkout image traced from CI through Amazon ECR and Inspector to EKS Pods, watched by GuardDuty Left, the CI pipeline, the counter and an attacker. Top, Amazon ECR repository shop/checkout with its scan setting, tag mutability, signatures and tag-to-digest list. Below, EKS cluster shop-prod with the API server, a Kyverno signature-check policy, and nodes running three checkout Pods, a quarantine NetworkPolicy and the GuardDuty agent. Right, Amazon Inspector, AWS Signer, Amazon GuardDuty, EventBridge and Security Hub, and Amazon Detective. The walkthrough shows a vulnerable image found by enhanced and continuous scanning, a tag overwrite fixed by immutability and digests, an unsigned image denied at admission, and a crypto miner caught by GuardDuty and isolated. CI pipeline builds checkout Attacker leaked IAM keys mining pool :3333 AMAZON ECR · 123456789012 · us-east-1 repository shop/checkout scan: basic · on push tags: MUTABLE signatures: none TAG → IMAGE DIGEST EKS CLUSTER shop-prod · NAMESPACE shop kube-apiserver RBAC → admission → etcd audit log: API requests EKS control plane, AWS-managed Kyverno · signature check + AWS Signer plugin or Ratify with Gatekeeper nodes · node group ng-shop m6i.large checkout-x7k2q checkout-m4p9d checkout-r2v8n NetworkPolicy quarantine checkout-r2v8n: deny all ingress and egress aws-guardduty-agent · one Pod per node EKS add-on · process, file, network, DNS events AWS SECURITY · us-east-1 Amazon Inspector AWS Signer profile shop_checkout_ci Amazon GuardDuty EKS Protection · audit log Runtime Monitoring · agent EventBridge · Security Hub findings routed and collected Amazon Detective

    2Quiz to check understanding

    Check yourself