Use TLS certificates for EKS Auto Mode load balancer listeners

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review all client facing EKS Auto Mode load balancers and verify that listeners use HTTPS or TLS with a valid certificate. For NLB backed Service resources, listener TLS is configured with annotations such as aws-load-balancer-ssl-cert for the ACM certificate ARN and aws-load-balancer-ssl-ports for the encrypted listener ports. For ALB backed Ingress resources, the certificate is configured through IngressClassParams using certificateARNs.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Configure every client facing EKS Auto Mode load balancer listener to use HTTPS or TLS with a valid certificate so client to load balancer traffic is encrypted in transit. For NLB backed Service resources, add the ACM certificate ARN and encrypted listener ports in the Service annotations. For ALB backed Ingress resources, configure HTTPS listener behavior through IngressClassParams and associate the required ACM certificate ARN using certificateARNs. If encryption is required beyond the load balancer, implement backend TLS separately because listener TLS alone protects only the client facing connection. • Add a valid ACM certificate to each client facing NLB or ALB listener that should serve encrypted traffic. • For NLB Services, set aws-load-balancer-ssl-cert to the ACM certificate ARN and aws-load-balancer-ssl-ports to the required listener ports.