AWS EKS Security Best Practices
- 1. EKS Security Best Practices Getting the Most from Amazon Elastic Kubernetes Service
- 2. 2©2019 StackRox. All rights reserved. AMAZO N EK S Amazon Elastic Kubernetes Service (Amazon EKS) makes it easy to deploy, manage, and scale containerized applications using Kubernetes on AWS.
- 3. 3©2019 StackRox. All rights reserved. What is Kubernetes? • Open-sourceContainer Workload Orchestrator • Design by Google based on their internal deployment practices • Workloads of “pods” containing one or more Docker containers • Manages starting/restarting/scaling workloads • Controllers allow for customized behaviors • Security management capabilities exist but generally not on by default
- 4. 4©2019 StackRox. All rights reserved. EKS Cluster Design Considerations EC2VPC Layout • Subnets across three+ Availability Zones • Private subnets + NAT Gateway(s) for worker nodes • Public subnets for ingress from Internet High Availability • EKS creates redundant control plane across three Availability Zones • User-created node groups should be across multipleAvailability Zones
- 5. 5©2019 StackRox. All rights reserved. EKS Cluster Networking AWSVPC CNI • EC2 security groups for traffic control • Firewall controls cannot be applied at deployment or namespace level • Does NOT support Kubernetes Network Policies • Not cloud portable • Not suitable for multi-tenant cluster network segregation Calico • Deploys alongside AWSVPC CNI • Install at any time • Full Kubernetes Network Policy support • Supported on all(?) Kubernetes providers • Very good controls for multi-tenant cluster network segregation
- 6. 6©2019 StackRox. All rights reserved. Secure Container Images EC2VPC Layout • Subnets across three+ Availability Zones • Private subnets + NAT Gateway(s) for worker nodes • Public subnets for ingress from Internet High Availability • EKS creates redundant control plane across three Availability Zones • User-created node groups should be across multipleAvailability Zones
- 7. 7©2019 StackRox. All rights reserved. Secure Container Images BuildTime • Start with a current, secure base image • Use separate build and runtime images • Don’t install unneeded software on the runtime image • Use an image scanner at build time and fail builds with flaws Third-Party Containers • Scan before deploying to production • Keep up-to-date • Use a Kubernetes admission controller to reject pods with insecure images • If necessary, build custom image to control content
- 8. 8©2019 StackRox. All rights reserved. Pod Runtime Security • Namespaces • Kubernetes Role-Based Access Control • Principle of Least Privilege • Roles instead of ClusterRoles, RoleBindings instead of ClusterRoleBindings • Use Network Policies (requiresCalico CNI) • Limit Container Runtime Privileges • Service Account for each application • Use PodSecurityPolicy resources to enforce Principle of Least Privilege • Protect EC2 Instance Role Credentials • kube2iam or Network Policies
- 9. 9©2019 StackRox. All rights reserved. Additional Best Practices Do the following: • Monitor security of clusters and their workloads • Follow all Helm security practices for tillerd • Make Kubernetes API endpoint private, if possible • Keep all resource manifests for each deployment together • Deploy with identical RBAC, Network Policies, etc., in staging before going to production Avoid the following: • Install the Kubernetes dashboard • NeglectAWS and EC2 security best practices
- 10. 10©2019 StackRox. All rights reserved. Get a free trial of the StackRox Kubernetes Security Platform today! Visit StackRox.com
- 11. 11©2019 StackRox. All rights reserved. TH AN K YO U