Policy Management in Amazon EKS

Policy Management in Amazon EKS An architecture diagram generated by Archify. AWS Organizations · Service Control Policies (SCPs) · AWS services → EKS integration points AWS Organizations Service Control Policies (SCPs) AWS Config · Config Rules · AWS services → EKS integration points AWS Config Config Rules AWS Firewall Manager · Firewall Policies · AWS services → EKS integration points AWS Firewall Manager Firewall Policies AWS IAM · IAM Roles for Service Accounts (IRSA) · AWS services → EKS integration points AWS IAM IAM Roles for Service Accounts (IRSA) AWS Security Groups · Security Groups for Pods · AWS services → EKS integration points AWS Security Groups Security Groups for Pods EKS Cluster · cluster level · EKS cluster (policy targets) EKS Cluster cluster level Namespace · namespace level · EKS cluster (policy targets) Namespace namespace level Pod · pod level · EKS cluster (policy targets) Pod pod level Kubernetes Policies · built-in policy mechanisms · Built-in Kubernetes policies Kubernetes Policies built-in policy mechanisms Policy Types · ResourceQuota · LimitRange · NetworkPolicy · PSS · Built-in Kubernetes policies Policy Types ResourceQuota · LimitRange · NetworkPolicy · PSS restricts audits protects grants permissions network security contains contains applied to type AWS services → EKS integration points EKS cluster (policy targets) Built-in Kubernetes policies

AWS service integration

  • • IRSA grants pods permissions to AWS services, applying least privilege
  • • SecurityGroupPolicy applies AWS security groups at the pod level
  • • AWS Config and Organizations apply organization-level policies (e.g. deny cluster creation without tags)
  • • AWS Firewall Manager centrally manages network policies across EKS clusters

Built-in Kubernetes policies

  • • ResourceQuota · LimitRange — namespace resource control
  • • NetworkPolicy — pod-to-pod traffic control
  • • Pod Security Standards — pod security levels