Use external secret storage for sensitive values

TinggiLevel 1Tinjauan manualeks-auto

Deskripsi

Use external secret storage to manage sensitive application values in AWS Secrets Manager or Systems Manager Parameter Store instead of relying only on native Kubernetes Secret objects. This approach lets EKS workloads consume secrets through integrations such as the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, while keeping secret lifecycle functions outside the cluster. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Audit the EKS Auto Mode cluster’s secrets architecture and verify that required workloads use an external secrets store such as AWS Secrets Manager or Systems Manager Parameter Store instead of relying only on Kubernetes Secret objects. The audit should confirm both the integration path and the workload access model, because external secret storage in EKS commonly uses the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, plus pod IAM through EKS Pod Identity or IRSA.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Use AWS Secrets Manager or Systems Manager Parameter Store as the primary store for application secrets. Update EKS workloads to retrieve those values through the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, using IAM through EKS Pod Identity or IRSA. This shifts encryption, access control, rotation, and auditing to AWS rather than leaving those functions primarily in cluster Secret objects. • Create the required secrets in AWS Secrets Manager or Parameter Store, and define least privilege IAM permissions so each workload identity can read only the specific secrets it requires. • Install and configure the Secrets Store CSI Driver and AWS Secrets and Configuration Provider if they are not already present.

Properti

Sistem operasi: Apa saja
Tag: eks-autopoliciessecrets
Referensi: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 4.4.2 Use external secret storage for sensitive values