EKS security group being flagged by Security Hub standard

Question

Hi all,

I have recently enabled Security Hub on my account where we have EKS set up via CDK. We have assigned the "AWS Foundational Security Best Practices v1.0.0" standard to Security Hub and it came up with a couple of findings. One of them is that the security group used by EKS is allowing all traffic to the ingress nodePorts. We are allowing all sources because we are doing client ip preservation on the NLB, so we can get the client IP addresses on the pods.
Is there some way around this/fix so it doesn't get flagged by this standard?
We enabled Security Hub to generate a report for a Facebook Data Protection Assessment that was required to our company.

Any help would be appreciated!
Best
Lior.

Answer

To address this finding, you can create a security group that allows traffic only from the NLB's security group or from specific IP ranges that are trusted. You can then update your EKS cluster to use this new security group instead of the existing one. Or you could use WAF to filter traffic based on specific criteria, such as IP address or geographic location. This can provide an additional layer of security to your application while still allowing you to preserve client IP addresses.

EKS security group being flagged by Security Hub standard

相關內容