Rule: Ensure AWS EKS Cluster Security Group Restricts Traffic
This rule ensures that the security group for AWS EKS cluster is not overly permissive to all traffic.
| Rule | Ensure AWS EKS cluster security group is not overly permissive to all traffic |
| Framework | CloudDefense.AI Security |
| Severity | ✔ High |
AWS EKS Cluster Security Group Rule for CloudDefense
Description:
AWS Elastic Kubernetes Service (EKS) clusters require a security group rule to regulate inbound and outbound traffic. The security group should be configured to allow only necessary traffic for the CloudDefense service, preventing unauthorized access and potential security breaches.
Rule Policy:
The rule policy enforces restricting the security group associated with the AWS EKS cluster to only allow traffic necessary for the CloudDefense service. This ensures a more secure environment by disallowing overly permissive access.
Troubleshooting Steps (if applicable):
If you encounter any issues with this rule, follow these troubleshooting steps to resolve them:
- 1.Ensure the correct security group is associated with your EKS cluster.
- 2.Verify that the rule is properly defined within the security group.
- 3.Double-check the network configuration and ensure that appropriate inbound and outbound rules are in place for CloudDefense.
- 4.Ensure the correct ports and protocols are allowed for CloudDefense's communication.
Necessary Code/Policy (if applicable):
Below is an example of the required security group rule using AWS CLI command:
aws ec2 authorize-security-group-ingress --group-id <security_group_id> --protocol tcp --port <port_number> --source <source_IP_range>
Replace
<security_group_id><port_number><source_IP_range>Step-by-step Guide for Remediation:
- 1.Identify the EKS cluster for which you want to enforce the security group rule.
- 2.Retrieve the security group ID associated with the EKS cluster.
- 3.Use the AWS CLI or AWS Management Console to modify the security group rules.
Using AWS CLI:
Step 1: Retrieve the security group ID:
Use the following AWS CLI command to retrieve the security group ID associated with the EKS cluster:
aws eks describe-cluster --name <cluster_name> --query 'cluster.resourcesVpcConfig.clusterSecurityGroupId' --output text
Replace
<cluster_name>Step 2: Modify the security group rule:
Run the following AWS CLI command to add the necessary security group rule:
aws ec2 authorize-security-group-ingress --group-id <security_group_id> --protocol tcp --port <port_number> --source <source_IP_range>
Replace
<security_group_id><port_number><source_IP_range>Using AWS Management Console:
Step 1: Retrieve the security group ID:
- 1.Log in to the AWS Management Console.
- 2.Navigate to the EC2 service.
- 3.Select "Security Groups" from the sidebar.
- 4.Locate the security group associated with your EKS cluster and make a note of its ID.
Step 2: Modify the security group rule:
- 1.Select the appropriate security group from the list.
- 2.Click on the "Inbound Rules" tab.
- 3.Click the "Edit inbound rules" button.
- 4.Add a new rule for CloudDefense by specifying the necessary port number and source IP range.
- 5.Save the changes.
Conclusion:
By enforcing this rule, you restrict the AWS EKS cluster's security group to only allow essential traffic for CloudDefense. This ensures a more secure environment by preventing unauthorized access and potential security breaches.