AWS Elastic Kubernetes Service (EKS) allows users to store secrets in Kubernetes Secrets. By default, these secrets are stored in plaintext in etcd. If an attacker gains access to etcd, they can read these secrets in plaintext. To prevent this, EKS provides encryption for Kubernetes secrets using the AWS Key Management Service (KMS). This ensures that the secrets are encrypted at rest in etcd. To ensure the security of the secrets stored in EKS, it is important to enable the secrets encryption feature. Enabling secrets encryption is accomplished by creating a KMS key, and granting the appropriate permissions to the Kubernetes service account that will manage the encryption and decryption of the secrets. Once this is set up, EKS will automatically encrypt all secrets stored in etcd using the KMS key. Ensuring that secrets encryption is enabled for EKS clusters can help to prevent unauthorized access to sensitive data.
To ensure that an AWS EKS cluster has secrets encryption enabled, the following remediation steps can be taken:
cat <<EOF > encryption-config.yaml
apiVersion: v1
kind: EncryptionConfig
resources:
- resources:
- secrets
providers:
- aescbc:
keys:
- name: key1
secret: <base64 encoded encryption key>
- identity: {}
EOF
Make sure to replace <base64 encoded encryption key> with a base64-encoded encryption key.
kubectl edit -n kube-system configmap/aws-auth
Add the following data block under the mapRoles section:
data:
mapRoles: |
- rolearn: <ARN of the node instance role>
username: system:node:{{EC2PrivateDNSName}}
groups:
- system:bootstrappers
- system:nodes
- rolearn: <ARN of the node instance role>
username: system:node:{{EC2PrivateDNSName}}
groups:
- system:bootstrappers
- system:nodes
kubernetes.io/role: <node-role>
mapUsers: |
Replace <ARN of the node instance role> with the ARN of the IAM role associated with the EKS nodes, and <node-role> with the name of the Kubernetes node role.
systemctl daemon-reload && systemctl restart kubelet
With these steps, secrets encryption can be enabled for an AWS EKS cluster.
