Use customer managed KMS keys for EKS envelope encryption of Kubernetes secrets

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the EKS cluster configuration and verify that Kubernetes secrets are protected with a customer managed KMS key, not only the default AWS-owned envelope-encryption key. For this control, the important check is whether the cluster is associated with a customer managed key for EKS envelope encryption. Also verify that the key is usable by the cluster, is in the same Region, and has not been disabled, deleted, or stripped of required grants or permissions.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the EKS cluster to use a customer managed KMS key for envelope encryption of Kubernetes secrets so secret data stored through the Kubernetes API is protected with a customer-controlled key encryption key in AWS KMS. This requires an existing symmetric KMS key in the same Region as the cluster, with key policy and grant permissions that allow EKS to use the key. The associate-encryption-config operation does not create a KMS key and does not encrypt arbitrary data directly. It associates an existing customer managed KMS key to the cluster so EKS can use it for envelope encryption of Kubernetes secrets. After the association is made, the cluster update must complete successfully and the key must remain enabled and accessible. Disabling, deleting, or breaking access to the associated key can place the cluster in a degraded or unrecoverable state.