Skip to content

Commit a38a3c5

Browse files
pbalogh-sapbalogh-sa
authored
feat: CIS EKS 1.5.0 (#1653)
* feat(cfg): add EKS 1.5.0 * fix(cfg): target map * fix: update eks job * fix: target mapping * feat: use CIS EKS 1.5.0 by default * fix: scored in node.yaml Signed-off-by: Peter Balogh <[email protected]> * doc: add CIS EKS 1.5.0 Signed-off-by: Peter Balogh <[email protected]> --------- Signed-off-by: Peter Balogh <[email protected]>
1 parent df48da4 commit a38a3c5

File tree

13 files changed

+1000
-8
lines changed

13 files changed

+1000
-8
lines changed

‎cfg/config.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,7 @@ version_mapping:
286286
"eks-1.0.1": "eks-1.0.1"
287287
"eks-1.1.0": "eks-1.1.0"
288288
"eks-1.2.0": "eks-1.2.0"
289+
"eks-1.5.0": "eks-1.5.0"
289290
"gke-1.0": "gke-1.0"
290291
"gke-1.2.0": "gke-1.2.0"
291292
"gke-1.6.0": "gke-1.6.0"
@@ -405,6 +406,12 @@ target_mapping:
405406
- "controlplane"
406407
- "policies"
407408
- "managedservices"
409+
"eks-1.5.0":
410+
- "master"
411+
- "node"
412+
- "controlplane"
413+
- "policies"
414+
- "managedservices"
408415
"rh-0.7":
409416
- "master"
410417
- "node"

‎cfg/eks-1.5.0/config.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
## Version-specific settings that override the values in cfg/config.yaml
3+
## These settings are required if you are using the --asff option to report findings to AWS Security Hub
4+
## AWS account number is required.
5+
AWS_ACCOUNT: "<AWS_ACCT_NUMBER>"
6+
## AWS region is required.
7+
AWS_REGION: "<AWS_REGION>"
8+
## EKS Cluster ARN is required.
9+
CLUSTER_ARN: "<AWS_CLUSTER_ARN>"

‎cfg/eks-1.5.0/controlplane.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
controls:
3+
version: "eks-1.5.0"
4+
id: 2
5+
text: "Control Plane Configuration"
6+
type: "controlplane"
7+
groups:
8+
- id: 2.1
9+
text: "Logging"
10+
checks:
11+
- id: 2.1.1
12+
text: "Enable audit Logs (Automated)"
13+
remediation: |
14+
From Console:
15+
1. For each EKS Cluster in each region;
16+
2. Go to 'Amazon EKS' > 'Clusters' > '' > 'Configuration' > 'Logging'.
17+
3. Click 'Manage logging'.
18+
4. Ensure that all options are toggled to 'Enabled'.
19+
API server: Enabled
20+
Audit: Enabled
21+
Authenticator: Enabled
22+
Controller manager: Enabled
23+
Scheduler: Enabled
24+
5. Click 'Save Changes'.
25+
26+
From CLI:
27+
# For each EKS Cluster in each region;
28+
aws eks update-cluster-config \
29+
--region '${REGION_CODE}' \
30+
--name '${CLUSTER_NAME}' \
31+
--logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'
32+
scored: false

‎cfg/eks-1.5.0/managedservices.yaml

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
---
2+
controls:
3+
version: "eks-1.5.0"
4+
id: 5
5+
text: "Managed Services"
6+
type: "managedservices"
7+
groups:
8+
- id: 5.1
9+
text: "Image Registry and Image Scanning"
10+
checks:
11+
- id: 5.1.1
12+
text: "Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider (Automated)"
13+
type: "manual"
14+
remediation: |
15+
To utilize AWS ECR for Image scanning please follow the steps below:
16+
17+
To create a repository configured for scan on push (AWS CLI):
18+
aws ecr create-repository --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
19+
20+
To edit the settings of an existing repository (AWS CLI):
21+
aws ecr put-image-scanning-configuration --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
22+
23+
Use the following steps to start a manual image scan using the AWS Management Console.
24+
25+
1. Open the Amazon ECR console at https://console.aws.amazon.com/ecr/repositories.
26+
2. From the navigation bar, choose the Region to create your repository in.
27+
3. In the navigation pane, choose Repositories.
28+
4. On the Repositories page, choose the repository that contains the image to scan.
29+
5. On the Images page, select the image to scan and then choose Scan.
30+
scored: false
31+
32+
- id: 5.1.2
33+
text: "Minimize user access to Amazon ECR (Manual)"
34+
type: "manual"
35+
remediation: |
36+
Before you use IAM to manage access to Amazon ECR, you should understand what IAM features
37+
are available to use with Amazon ECR. To get a high-level view of how Amazon ECR and other
38+
AWS services work with IAM, see AWS Services That Work with IAM in the IAM User Guide.
39+
scored: false
40+
41+
- id: 5.1.3
42+
text: "Minimize cluster access to read-only for Amazon ECR (Manual)"
43+
type: "manual"
44+
remediation: |
45+
You can use your Amazon ECR images with Amazon EKS, but you need to satisfy the following prerequisites.
46+
47+
The Amazon EKS worker node IAM role (NodeInstanceRole) that you use with your worker nodes must possess
48+
the following IAM policy permissions for Amazon ECR.
49+
50+
{
51+
"Version": "2012-10-17",
52+
"Statement": [
53+
{
54+
"Effect": "Allow",
55+
"Action": [
56+
"ecr:BatchCheckLayerAvailability",
57+
"ecr:BatchGetImage",
58+
"ecr:GetDownloadUrlForLayer",
59+
"ecr:GetAuthorizationToken"
60+
],
61+
"Resource": "*"
62+
}
63+
]
64+
}
65+
scored: false
66+
67+
- id: 5.1.4
68+
text: "Minimize Container Registries to only those approved (Manual)"
69+
type: "manual"
70+
remediation: |
71+
To minimize AWS ECR container registries to only those approved, you can follow these steps:
72+
73+
1. Define your approval criteria: Determine the criteria that containers must meet to
74+
be considered approved. This can include factors such as security, compliance,
75+
compatibility, and other requirements.
76+
2. Identify all existing ECR registries: Identify all ECR registries that are currently
77+
being used in your organization.
78+
3. Evaluate ECR registries against approval criteria: Evaluate each ECR registry
79+
against your approval criteria to determine whether it should be approved or not.
80+
This can be done by reviewing the registry settings and configuration, as well as
81+
conducting security assessments and vulnerability scans.
82+
4. Establish policies and procedures: Establish policies and procedures that outline
83+
how ECR registries will be approved, maintained, and monitored. This should
84+
include guidelines for developers to follow when selecting a registry for their
85+
container images.
86+
5. Implement access controls: Implement access controls to ensure that only
87+
approved ECR registries are used to store and distribute container images. This
88+
can be done by setting up IAM policies and roles that restrict access to
89+
unapproved registries or create a whitelist of approved registries.
90+
6. Monitor and review: Continuously monitor and review the use of ECR registries
91+
to ensure that they continue to meet your approval criteria. This can include
92+
scored: false
93+
94+
- id: 5.2
95+
text: "Identity and Access Management (IAM)"
96+
checks:
97+
- id: 5.2.1
98+
text: "Prefer using dedicated Amazon EKS Service Accounts (Automated)"
99+
type: "manual"
100+
remediation: |
101+
With IAM roles for service accounts on Amazon EKS clusters, you can associate an
102+
IAM role with a Kubernetes service account. This service account can then provide
103+
AWS permissions to the containers in any pod that uses that service account. With this
104+
feature, you no longer need to provide extended permissions to the worker node IAM
105+
role so that pods on that node can call AWS APIs.
106+
Applications must sign their AWS API requests with AWS credentials. This feature
107+
provides a strategy for managing credentials for your applications, similar to the way
108+
that Amazon EC2 instance profiles provide credentials to Amazon EC2 instances.
109+
Instead of creating and distributing your AWS credentials to the containers or using the
110+
Amazon EC2 instance’s role, you can associate an IAM role with a Kubernetes service
111+
account. The applications in the pod’s containers can then use an AWS SDK or the
112+
AWS CLI to make API requests to authorized AWS services.
113+
114+
The IAM roles for service accounts feature provides the following benefits:
115+
116+
- Least privilege - By using the IAM roles for service accounts feature, you no
117+
longer need to provide extended permissions to the worker node IAM role so that
118+
pods on that node can call AWS APIs. You can scope IAM permissions to a
119+
service account, and only pods that use that service account have access to
120+
those permissions. This feature also eliminates the need for third-party solutions
121+
such as kiam or kube2iam.
122+
- Credential isolation - A container can only retrieve credentials for the IAM role
123+
that is associated with the service account to which it belongs. A container never
124+
has access to credentials that are intended for another container that belongs to
125+
another pod.
126+
- Audit-ability - Access and event logging is available through CloudTrail to help
127+
ensure retrospective auditing.
128+
scored: false
129+
130+
- id: 5.3
131+
text: "AWS EKS Key Management Service"
132+
checks:
133+
- id: 5.3.1
134+
text: "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS (Manual)"
135+
type: "manual"
136+
remediation: |
137+
This process can only be performed during Cluster Creation.
138+
139+
Enable 'Secrets Encryption' during Amazon EKS cluster creation as described
140+
in the links within the 'References' section.
141+
scored: false
142+
143+
- id: 5.4
144+
text: "Cluster Networking"
145+
checks:
146+
- id: 5.4.1
147+
text: "Restrict Access to the Control Plane Endpoint (Automated)"
148+
type: "manual"
149+
remediation: |
150+
By enabling private endpoint access to the Kubernetes API server, all communication
151+
between your nodes and the API server stays within your VPC. You can also limit the IP
152+
addresses that can access your API server from the internet, or completely disable
153+
internet access to the API server.
154+
With this in mind, you can update your cluster accordingly using the AWS CLI to ensure
155+
that Private Endpoint Access is enabled.
156+
If you choose to also enable Public Endpoint Access then you should also configure a
157+
list of allowable CIDR blocks, resulting in restricted access from the internet. If you
158+
specify no CIDR blocks, then the public API server endpoint is able to receive and
159+
process requests from all IP addresses by defaulting to ['0.0.0.0/0'].
160+
For example, the following command would enable private access to the Kubernetes
161+
API as well as limited public access over the internet from a single IP address (noting
162+
the /32 CIDR suffix):
163+
aws eks update-cluster-config --region $AWS_REGION --name $CLUSTER_NAME --resources-vpc-config endpointPrivateAccess=true,endpointPrivateAccess=true,publicAccessCidrs="203.0.113.5/32"
164+
165+
Note: The CIDR blocks specified cannot include reserved addresses.
166+
There is a maximum number of CIDR blocks that you can specify. For more information,
167+
see the EKS Service Quotas link in the references section.
168+
For more detailed information, see the EKS Cluster Endpoint documentation link in the
169+
references section.
170+
scored: false
171+
172+
- id: 5.4.2
173+
text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Automated)"
174+
type: "manual"
175+
remediation: |
176+
By enabling private endpoint access to the Kubernetes API server, all communication
177+
between your nodes and the API server stays within your VPC.
178+
With this in mind, you can update your cluster accordingly using the AWS CLI to ensure
179+
that Private Endpoint Access is enabled.
180+
For example, the following command would enable private access to the Kubernetes
181+
API and ensure that no public access is permitted:
182+
aws eks update-cluster-config --region $AWS_REGION --name $CLUSTER_NAME --resources-vpc-config endpointPrivateAccess=true,endpointPublicAccess=false
183+
184+
Note: For more detailed information, see the EKS Cluster Endpoint documentation link
185+
in the references section.
186+
scored: false
187+
188+
- id: 5.4.3
189+
text: "Ensure clusters are created with Private Nodes (Automated)"
190+
type: "manual"
191+
remediation: |
192+
aws eks update-cluster-config \
193+
--region region-code \
194+
--name my-cluster \
195+
--resources-vpc-config endpointPublicAccess=true,publicAccessCidrs="203.0.113.5/32",endpointPrivateAccess=true
196+
scored: false
197+
198+
- id: 5.4.4
199+
text: "Ensure Network Policy is Enabled and set as appropriate (Automated)"
200+
type: "manual"
201+
remediation: |
202+
Utilize Calico or other network policy engine to segment and isolate your traffic.
203+
scored: false
204+
205+
- id: 5.4.5
206+
text: "Encrypt traffic to HTTPS load balancers with TLS certificates (Manual)"
207+
type: "manual"
208+
remediation: |
209+
Your load balancer vendor can provide details on configuring HTTPS with TLS.
210+
scored: false
211+
212+
213+
- id: 5.5
214+
text: "Authentication and Authorization"
215+
checks:
216+
- id: 5.5.1
217+
text: "Manage Kubernetes RBAC users with AWS IAM Authenticator for Kubernetes or Upgrade to AWS CLI v1.16.156 or greater (Manual)"
218+
type: "manual"
219+
remediation: |
220+
Refer to the 'Managing users or IAM roles for your cluster' in Amazon EKS documentation.
221+
222+
Note: If using AWS CLI version 1.16.156 or later there is no need to install the AWS
223+
IAM Authenticator anymore.
224+
The relevant AWS CLI commands, depending on the use case, are:
225+
aws eks update-kubeconfig
226+
aws eks get-token
227+
scored: false

‎cfg/eks-1.5.0/master.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
controls:
3+
version: "eks-1.5.0"
4+
id: 1
5+
text: "Control Plane Components"
6+
type: "master"

0 commit comments

Comments
 (0)