Use customer managed KMS keys for EKS envelope encryption of Kubernetes secrets

ÉlevéeNiveau 1Revue manuelleeks

Description

Using customer managed KMS keys for EKS envelope encryption adds a customer-controlled protection layer for Kubernetes secrets stored through the Kubernetes API. This strengthens data-at-rest protection while allowing organizations to manage key ownership, rotation, policy, and audit visibility for the key used to protect secret data. The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Review the EKS cluster configuration and verify that Kubernetes secrets are protected with a customer managed KMS key, not only the default AWS-owned envelope-encryption key. For this control, the important check is whether the cluster is associated with a customer managed key for EKS envelope encryption. Also verify that the key is usable by the cluster, is in the same Region, and has not been disabled, deleted, or stripped of required grants or permissions.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure the EKS cluster to use a customer managed KMS key for envelope encryption of Kubernetes secrets so secret data stored through the Kubernetes API is protected with a customer-controlled key encryption key in AWS KMS. This requires an existing symmetric KMS key in the same Region as the cluster, with key policy and grant permissions that allow EKS to use the key. The associate-encryption-config operation does not create a KMS key and does not encrypt arbitrary data directly. It associates an existing customer managed KMS key to the cluster so EKS can use it for envelope encryption of Kubernetes secrets. After the association is made, the cluster update must complete successfully and the key must remain enabled and accessible. Disabling, deleting, or breaking access to the associated key can place the cluster in a degraded or unrecoverable state.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: eksmanaged-servicessecrets
Référence: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.3.1 Use customer managed KMS keys for EKS envelope encryption of Kubernetes secrets