Rule: EKS Clusters Endpoint Should Restrict Public Access

Rule Description

Troubleshooting Steps

2. 1.
   Check the current security group configuration for the EKS clusters.
4. 2.
   Verify if there are any inbound rules allowing public access to the endpoint.
6. 3.
   Verify if the outbound rules are configured correctly to restrict public access.
8. 4.
   Make sure that the network access control list (ACL) associated with the subnet allows the necessary traffic.
10. 5.
    Check if any network load balancer, application load balancer, or ingress controllers are misconfigured, allowing public access.
12. 6.
    Validate if the Kubernetes network policies are correctly set up to restrict public access.

Necessary Codes

2. 1.
   Create/update Kubernetes network policies:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-public-access
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 0.0.0.0/0

2. 1.
   Configure Security Group rules for the EKS clusters:

aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port <port> --source-security-group <source-security-group-id>

Step-by-Step Guide for Remediation

2. 1.
   Identify the EKS cluster that needs to be secured.
4. 2.
   Review the current security group configuration associated with the cluster.
6. 3.
   Update the security group to remove any existing inbound rules allowing public access to the required ports (e.g., 80, 443).
8. 4.
   Implement network policies to deny all incoming traffic from any IP block except for private addresses.

   • Create a YAML file with the provided code snippet for the network policy.
   • Apply the network policy using the following command:

     kubectl apply -f network_policy.yaml
     
10. 5.
    Validate if the network policies are correctly applied:

    kubectl get networkpolicy
    

    Ensure that the "deny-public-access" network policy is present and has the desired pod selector and ingress rules.
12. 6.
    Update the security group associated with the EKS cluster to authorize inbound traffic only from specific security groups if required.

    • Use the provided CLI command, replacing

      <security-group-id>

      and

      <source-security-group-id>

      with the appropriate values.
    • Repeat this step for each required port.
14. 7.
    Test the access by attempting to connect to the EKS cluster's endpoint from a public IP address. Verify that the connection is denied.
16. 8.
    Repeat the steps for each EKS cluster that needs public access restriction.