EKS should have the encryption of secrets enabled
EKS cluster resources should have the encryption_config block set with protection of the secrets resource.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable encryption of EKS secrets
1
2
3
4
5
6
7
8
9
10
|
Resources:
GoodExample:
Type: AWS::EKS::Cluster
Properties:
EncryptionConfig:
- Provider:
KeyArn: alias/eks-kms
Resources:
- secrets
Name: goodExample
|
Enable encryption of EKS secrets
1
2
3
4
5
6
7
8
9
10
11
12
|
resource "aws_kms_key" "eks" {
enable_key_rotation = true
}
resource "aws_eks_cluster" "good_example" {
encryption_config {
resources = ["secrets"]
provider {
key_arn = aws_kms_key.eks.arn
}
}
}
|
Links