EKS Security Architecture

EKS Security Architecture An architecture diagram generated by Archify. AWS IAM · Identity and access · AWS Responsibility AWS IAM Identity and access EKS Control Plane · AWS managed · AWS Responsibility EKS Control Plane AWS managed etcd · Cluster state store · AWS Responsibility etcd Cluster state store AWS KMS · Secrets encryption · AWS Responsibility AWS KMS Secrets encryption Worker Nodes · EC2 / node groups · Customer Responsibility Worker Nodes EC2 / node groups Pods / Containers · Workloads · Customer Responsibility Pods / Containers Workloads Security Groups · Node network control · Customer Responsibility Security Groups Node network control Service Accounts · RBAC / IRSA · Customer Responsibility Service Accounts RBAC / IRSA Network Policies · Pod-to-pod traffic control · Customer Responsibility Network Policies Pod-to-pod traffic control Kubernetes Secrets · Sensitive data · Customer Responsibility Kubernetes Secrets Sensitive data Authentication / Authorization Encrypted communication Managed Encrypted communication Run Apply Use Apply Use AWS Responsibility Customer Responsibility

AWS Responsibility

  • • AWS manages the security of the EKS control plane and etcd
  • • AWS KMS encrypts Secrets stored in etcd
  • • AWS IAM credentials authenticate to the Kubernetes API server

Customer Responsibility

  • • Security of worker nodes, containers, and applications
  • • Security groups and network policies control traffic
  • • Service accounts (RBAC, IRSA) and Secrets management