Allow only approved container registries for images used by EKS workloads

MédiaNível 1Revisão manualeks

Descrição

Allowing only approved container registries for images used by EKS workloads helps reduce supply chain risk by limiting where workloads can source their images. This creates a controlled image origin model in which clusters admit workloads only from trusted registries and can pair that control with image-signature verification before containers are allowed to run. The benchmark marks this recommendation Manual.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Review the image sources currently used by the cluster and the admission controls that govern new deployments, then verify that workloads are limited to approved registries only. The strongest implementation for this control is an admission-time policy, because policy-as-code solutions such as Kyverno and OPA Gatekeeper can intercept Kubernetes API requests before the change is persisted, and image-security guidance for EKS describes using admission controllers to verify image trust conditions before deployment.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Restrict EKS workloads to approved container registries by enforcing image-source controls at admission time, rather than relying only on CI/CD checks or written standards. Enforcement is typically implemented with a policy-as-code admission controller such as Kyverno or Gatekeeper so image references are checked before the deployment is persisted. The allowlist must also include the Region-specific ECR registries required for EKS platform components and add-ons, because EKS add-on images are pulled from Amazon ECR private repositories replicated per Region. • Include internal ECR repositories, explicitly approved third-party registries, and the Region-specific ECR registries required for EKS add-ons and platform components in the approved registry allowlist.

Propriedades

Sistemas operacionais: Qualquer
Tags: eksmanaged-servicesregistry
Referência: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.1.4 Allow only approved container registries for images used by EKS workloads