EKS security group being flagged by Security Hub standard

Hi all,

I have recently enabled Security Hub on my account where we have EKS set up via CDK. We have assigned the "AWS Foundational Security Best Practices v1.0.0" standard to Security Hub and it came up with a couple of findings. One of them is that the security group used by EKS is allowing all traffic to the ingress nodePorts. We are allowing all sources because we are doing client ip preservation on the NLB, so we can get the client IP addresses on the pods. Is there some way around this/fix so it doesn't get flagged by this standard? We enabled Security Hub to generate a report for a Facebook Data Protection Assessment that was required to our company.

Any help would be appreciated! Best Lior.

トピック

セキュリティ、アイデンティティ、コンプライアンスコンテナネットワークとコンテンツ配信

タグ

AWS Security Hub Amazon Elastic Kubernetes Service セキュリティグループ

言語

English

Lior

質問済み 1年前280ビュー

1回答

新しい順
投票が多い順
コメントが多い順

これらの回答は役に立ちましたか？コミュニティがあなたの知識を活用できるように、正解に賛成票を投じてください。

To address this finding, you can create a security group that allows traffic only from the NLB's security group or from specific IP ranges that are trusted. You can then update your EKS cluster to use this new security group instead of the existing one. Or you could use WAF to filter traffic based on specific criteria, such as IP address or geographic location. This can provide an additional layer of security to your application while still allowing you to preserve client IP addresses.

Wilklins

回答済み 1年前

Lior
1年前
From my understanding if I have client IP preservation, the source IP that I will see will not be from the NLBs but from the client IPs, or am I wrong in this assumption? If this is correct, then I cannot limit an IP range because the public ingress needs to allow everyone to connect to it.

EKS security group being flagged by Security Hub standard

関連するコンテンツ