Use TLS certificates on EKS load balancer listeners for encrypted client connections

높음레벨 1수동 검토eks

설명

Using TLS certificates on EKS load balancer listeners protects client-to-load-balancer traffic in transit by presenting a trusted server certificate and negotiating encrypted HTTPS or TLS connections at the listener. In EKS, this commonly means configuring TLS on an NLB listener for Service resources or specifying certificate ARNs for ALB-based ingress so externally exposed application entry points do not rely on unencrypted HTTP. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review all EKS Service resources of type LoadBalancer and all Ingress resources that expose client traffic, and verify that client-facing listeners use HTTPS or TLS with a valid certificate. For NLB-backed Service resources, listener encryption is configured with annotations such as aws-load-balancer-ssl-cert and aws-load-balancer-ssl-ports. For ALB-backed ingress, HTTPS listeners require certificate configuration on the ALB path. A TCP listener on port 443 is a different design because it passes encrypted traffic through instead of terminating TLS at the load balancer.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure every client-facing EKS load balancer listener to use HTTPS or TLS with a valid certificate so client-to-load-balancer traffic is encrypted in transit. For NLB-backed Service resources, add the certificate ARN and encrypted listener ports in the service annotations. For ALB-backed ingress, configure HTTPS listeners and associate the required certificate ARN. If the design requires encryption beyond the load balancer, implement backend TLS separately because listener TLS alone protects only the client-facing connection. • Add a valid certificate to each client-facing NLB or ALB listener that should serve encrypted traffic. • For NLB services, set aws-load-balancer-ssl-cert to the certificate ARN and aws-load-balancer-ssl-ports to the required listener ports. • For ALB ingress, configure HTTPS listeners and associate the required certificate ARN with the listener configuration.

속성

운영 체제: 모두
태그: eksmanaged-servicesnetworksecrets
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.4.4 Use TLS certificates on EKS load balancer listeners for encrypted client connections