EKS Network Security Architecture

EKS Network Security Architecture An architecture diagram generated by Archify. Internet · External traffic · Architecture component Internet External traffic Application Load Balancer · Public entry point · Amazon VPC › Public Subnets › ALB Security Group Application Load Balancer Public entry point Bastion Host · Administrator access · Amazon VPC › Public Subnets › Bastion Security Group Bastion Host Administrator access EKS Control Plane · API server · Amazon VPC › Private Subnets · EKS Cluster › Control Plane Security Group EKS Control Plane API server Worker Nodes × 3 · Private subnets · Amazon VPC › Private Subnets · EKS Cluster › Node Security Group Worker Nodes × 3 Private subnets Network Policies · Default deny + app allow · Amazon VPC › Private Subnets · EKS Cluster Network Policies Default deny + app allow VPC Endpoints · ECR API / ECR DKR / S3 / STS · Amazon VPC VPC Endpoints ECR API / ECR DKR / S3 / STS manages applies private access Amazon VPC Public Subnets Private Subnets · EKS Cluster ALB Security Group Bastion Security Group Control Plane Security Group Node Security Group Legend Backend Cloud Security External

Security Groups

  • • Cluster security group: allows control plane ↔ worker node traffic
  • • Ports 443 (API server), 10250 (kubelet), 1025-65535 (inter-node)
  • • Node security group: inbound only from the cluster security group

Network Policies

  • • default-deny: podSelector {} blocks all Ingress and Egress
  • • api-allow: frontend → api pods on TCP 8080 only
  • • Implemented via Amazon VPC CNI, Calico, or Cilium

VPC Endpoints

  • • ecr.api, ecr.dkr, s3, logs, sts recommended
  • • Private access without traversing an internet gateway