To this end, ARMO developed custom controls, or mapped existing controls to the CIS EKS benchmark. This gives users the most comprehensive solution for EKS benchmarking available to date. These are also places you can get your results.ĪRMO CIS EKS controls scan all of the categories mentioned above. Not only does it offer remediations for manifests you deployed to the cluster, but also to the cluster itself using the aws eks command line tool or the EKS console. However, by introducing the EKS-specific CIS Benchmark, engineers have an option that caters specifically to their needs. To that end we add layers of security in an automated fashion to the tools in the DevOps stack. The Kubernetes CIS Benchmark is helpful and relevant to EKS users. Please note the numbering follows the benchmark numbering, which is why it starts at (2):ĪRMO’s mission is to keep DevOps engineers security aware, without adding to their burden. The EKS CIS Benchmark covers five subsections. For Amazon EKS, AWS is responsible for the Kubernetes control plane, which includes the control plane nodes and etcd database.” In the graphic below, you can see where AWS draws the line for the users of EKS.įigure 1: AWS Shared Responsibility Model (source) According to the CIS AKS Benchmark: “AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. That said, you cannot be lulled into a false sense of security by this. This is thanks to the fact that many of the security aspects are covered by the service provider. While the General Kubernetes CIS Benchmark covers all aspects of securing your Kubernetes infrastructure, the ones for managed Kubernetes distributions are much abbreviated.

You can analyze the root cause for security misconfigurations, and fix them with assisted remediations. With it, as an EKS user, you can better identify security compliance gaps. However, to better serve EKS users, ARMO recently introduced support for the EKS-specific variant of the CIS benchmark. The list includes the general Kubernetes CIS Benchmark. Currently, ARMO Platform supports three industry-recognized frameworks out of the box. This is where solutions like ARMO Platform can be of great help. The shared responsibility model from AWS means that users are accountable for their EKS cluster’s security. It offers a managed service that makes it easy for organizations to run Kubernetes at scale. Amazon’s Elastic Kubernetes Service (EKS) is one of the most popular ways to deploy Kubernetes clusters in the cloud. As a result, many organizations have turned to Kubernetes to help them modernize their IT infrastructure and improve their application deployment processes. In recent years, Kubernetes has become the de facto standard for container orchestration. Now, with Amazon Elastic Kubernetes Service (EKS) users can add this specific benchmark to the frameworks already available to them. ARMO Platform has added the CIS EKS benchmark.

Kubernetes cis benchmark