By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

EKS security group being flagged by Security Hub standard

0

Hi all,

I have recently enabled Security Hub on my account where we have EKS set up via CDK. We have assigned the "AWS Foundational Security Best Practices v1.0.0" standard to Security Hub and it came up with a couple of findings. One of them is that the security group used by EKS is allowing all traffic to the ingress nodePorts. We are allowing all sources because we are doing client ip preservation on the NLB, so we can get the client IP addresses on the pods. Is there some way around this/fix so it doesn't get flagged by this standard? We enabled Security Hub to generate a report for a Facebook Data Protection Assessment that was required to our company.

Any help would be appreciated! Best Lior.

Topics
Security, Identity, & ComplianceContainersNetworking & Content Delivery
Tags
AWS Security HubAmazon Elastic Kubernetes ServiceSecurity Group
Language
English
Lior
asked a year ago267 views
1 Answer
0

To address this finding, you can create a security group that allows traffic only from the NLB's security group or from specific IP ranges that are trusted. You can then update your EKS cluster to use this new security group instead of the existing one. Or you could use WAF to filter traffic based on specific criteria, such as IP address or geographic location. This can provide an additional layer of security to your application while still allowing you to preserve client IP addresses.

Wilklins
answered a year ago
  • Lior
    a year ago

    From my understanding if I have client IP preservation, the source IP that I will see will not be from the NLBs but from the client IPs, or am I wrong in this assumption? If this is correct, then I cannot limit an IP range because the public ingress needs to allow everyone to connect to it.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content