Security & Governance
Security in Amazon EKS environments requires a Defense in Depth strategy and continuous security posture assessment rather than a single perimeter. This chapter covers the full security lifecycle: cluster access control (authentication/authorization), policy-based governance, supply chain security, runtime threat detection, and incident response.
Security governance goes beyond technical controls โ it embeds organizational policies, processes, and compliance requirements into code and infrastructure. Regulated industries such as financial services must comply with frameworks like PCI-DSS, SOC 2, and ISO 27001, which requires automated policy enforcement, continuous audit logging, and real-time threat detection. Integrating Kubernetes-native security capabilities (RBAC, Network Policy, Pod Security Standards) with AWS cloud-native services (IAM, KMS, GuardDuty) builds a strong security posture grounded in Zero Trust principles.
Key Documentsโ
Architecture Patternsโ
Security Domains โ
The security architecture consists of five layers: cluster, network, workload, secrets, and data.
Cluster security (authentication/authorization) is implemented through the integration of AWS IAM and Kubernetes RBAC. Access Entry-based authentication modes, selection criteria between EKS Pod Identity and IRSA, enterprise IdP (OIDC) integration, and access patterns for Non-Standard Callers such as CI/CD and monitoring tools are covered in detail in the EKS API Server AuthN/AuthZ guide. New projects should evaluate EKS Pod Identity first, which binds IAM roles directly to Pods without OIDC provider setup.
Network security controls Pod-to-Pod communication with Kubernetes Network Policy and implements namespace isolation. See VPC CNI Deep Dive for how VPC CNI implements NetworkPolicy, and the Service Mesh Comparison Guide for automated mTLS with a service mesh.
Workload security enforces the Restricted level of Pod Security Standards to block root execution, restrict host network access, and drop dangerous capabilities. Container images are scanned in the CI/CD pipeline to block vulnerabilities upfront, and policies enforce the use of signed images from approved registries only. Policy enforcement automation is covered in Policy Management with Kyverno, and image signing/SBOM in Container Supply Chain Security.
Secrets management integrates AWS Secrets Manager with External Secrets Operator for centralized management. Secrets are kept in an external secret store instead of being stored directly as Kubernetes Secrets, with automatic rotation and periodic synchronization minimizing exposure risk. See GitOps-based EKS Cluster Operations for the secrets management architecture in GitOps environments.
Data security includes encryption for both data at rest and in transit. EBS volumes are protected at the block level with KMS-based encryption, and etcd transparently encrypts Kubernetes configuration data through AWS KMS integration. Data in transit is encrypted with TLS/mTLS; HTTPS is enforced at the ingress level with certificates automatically renewed by Cert Manager.
Compliance Frameworksโ
Compliance requires integrating technical implementation with organizational processes. SOC 2 covers data security, availability, and processing integrity โ implemented through highly available architecture, data encryption, and access control. PCI-DSS, essential for payment card data processing, requires network isolation, data encryption, and periodic security assessments. HIPAA requires data encryption and audit logging for healthcare data, GDPR requires data minimization and processing transparency, and ISO 27001 provides the overall framework for information security management systems.
In EKS environments, compliance requirements map to technical controls.
| Requirement | Implementation |
|---|---|
| Access control | AWS IAM + Kubernetes RBAC (Access Entry, Pod Identity) |
| Encryption | TLS/mTLS, AWS KMS envelope encryption |
| Audit trail | CloudTrail API logging, Control Plane audit logs |
| Threat detection | GuardDuty, Security Hub unified dashboard |
| Policy enforcement | Kyverno / OPA Gatekeeper admission control |
| Configuration compliance | Continuous monitoring with AWS Config rules |
Security Tools & Technologiesโ
Open source tools include Falco for detecting runtime anomalies at the system call level, Kyverno and OPA Gatekeeper for validating policies at deployment time via admission webhooks, Trivy for scanning container images and filesystems for vulnerabilities, kube-bench for CIS Kubernetes Benchmark-based configuration assessment, and kube-hunter for cluster penetration testing.
AWS native services include AWS WAF for blocking web attacks such as SQL injection and XSS, AWS Shield for DDoS protection, Amazon Inspector for continuous vulnerability assessment of EC2 instances and container images, and AWS Systems Manager for patch automation.
Security Monitoring & Responseโ
Security events are collected from multiple sources โ CloudTrail, VPC Flow Logs, application and container logs โ and aggregated into a centralized log store. GuardDuty uses machine learning to automatically detect abnormal API call patterns, suspicious network activity, and compromised instance behavior; integrating EventBridge and Lambda automates isolation, alerting, and recovery. For hands-on configuration of GuardDuty Extended Threat Detection and automated Pod isolation, see the GuardDuty integration section in EKS Pod Health Check & Lifecycle Management.
Incident response follows a repeatable procedure: detection โ analysis โ containment โ recovery โ post-mortem. See the EKS Debugging Guide for diagnosis and recovery procedures by failure type, and Default Namespace Incident Response for a representative security governance failure that causes Control Plane access loss.
Security Roadmap 2025โ
Latest Security Features (AWS re:Invent 2025)โ
| Feature | Status | Impact |
|---|---|---|
| GuardDuty Extended Threat Detection | GA | Enhanced container threat detection (EKS Protection required, Runtime Monitoring recommended) |
| IAM Policy Autopilot | GA | Open source available (re:Invent 2025, awslabs/iam-policy-autopilot) |
| EKS Pod Identity | GA | Replaces/complements IRSA |
| Security Hub Analytics | GA | Real-time risk quantification |
| ECR Enhanced Scanning | GA | Strengthened supply chain security |
Kyverno v1.17+ Key Updates (currently v1.18)โ
- CEL-based policies v1 GA (since 1.17): Uses Common Expression Language instead of Rego, production-ready
- Namespace CEL policies: Autonomous per-team policy management
- Fine-grained policy exceptions: Granular exception handling
- Improved observability: Policy enforcement metrics and dashboards
Related Documentsโ
- EKS Debugging Guide โ Incident triage and per-domain debugging
- GitOps-based EKS Cluster Operations โ Secrets management and RBAC governance
- EKS Hybrid Nodes โ Node authentication and security in hybrid environments