Use TLS certificates for EKS Auto Mode load balancer listeners

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review all client facing EKS Auto Mode load balancers and verify that listeners use HTTPS or TLS with a valid certificate. For NLB backed Service resources, listener TLS is configured with annotations such as aws-load-balancer-ssl-cert for the ACM certificate ARN and aws-load-balancer-ssl-ports for the encrypted listener ports. For ALB backed Ingress resources, the certificate is configured through IngressClassParams using certificateARNs.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure every client facing EKS Auto Mode load balancer listener to use HTTPS or TLS with a valid certificate so client to load balancer traffic is encrypted in transit. For NLB backed Service resources, add the ACM certificate ARN and encrypted listener ports in the Service annotations. For ALB backed Ingress resources, configure HTTPS listener behavior through IngressClassParams and associate the required ACM certificate ARN using certificateARNs. If encryption is required beyond the load balancer, implement backend TLS separately because listener TLS alone protects only the client facing connection. • Add a valid ACM certificate to each client facing NLB or ALB listener that should serve encrypted traffic. • For NLB Services, set aws-load-balancer-ssl-cert to the ACM certificate ARN and aws-load-balancer-ssl-ports to the required listener ports.