search

awslabs / amazon-eks-ami

Packer configuration for building a custom EKS AMI
https://awslabs.github.io/amazon-eks-ami/
MIT No Attribution
2.42k stars 1.14k forks source link

Can we implement EKS-AMI hardening? #245

Open khetanvallurupalli opened 5 years ago

khetanvallurupalli commented 5 years ago

As per Our Infosec team, Every server should be using Hardened AMI according to there policies. While we do the same for EKS AMI worker nodes are terminated before starting. Any suggestions?

rickard-von-essen commented 5 years ago

Did you check why?

khetanvallurupalli commented 5 years ago

As there AMI has passed the CIS benchmark test. with some agents like Splunk and TrendMicro are Baked into it. As we scanned the Base EKS AMI for CIS benchmarks it got 58%. So we need to go with EKS-AMI hardening where it fails to launch a worker node.

micahhausler commented 5 years ago

@khetanvallurupalli We have an issue (#99) for CIS benchmarks, would that cover your use case or are there additional changes?

pthrasher commented 5 years ago

it may not be accurate... but I believe there's sort of 2 levels here. Linux ami hardening, and then kube hardening. Both with separate benchmarks from CIS.

burnertoday commented 5 years ago

@pthrasher I believe you are correct:

Kubenetes hardening: CIS_Kubernetes_Benchmark_v1.4.1.pdf AMI Hardening: CIS_Amazon_Linux_Benchmark_v2.1.0.pdf

There is no specific and official CIS hardened AMI for EKS that I can find. If anyone else can please point us.

hawkesn commented 5 years ago

Hi everyone, Looking for some direction here. Is this on AWS' roadmap? I'm currently looking at trying to harden the AMI myself (specifically the linux AMI hardening) but if the work is already being done then that's great. Otherwise, I'm willing to open a PR but I would like some direction the preferred approach.

yatintaluja commented 4 years ago

Looking for aws hardened image, what are the options available currently.

hawkesn commented 4 years ago

Looking for aws hardened image, what are the options available currently.

Nothing official from AWS that I can find, but there are python/ansible scripts that you can search up on Github that are unofficial

KYannick commented 4 years ago

Does anyone has an idea what the status is of this issue? Are there plans to provide hardened images for EKS?

peteroruba commented 4 years ago

I am surprised this receives so little attention.

Gangaram-Dewasi commented 3 years ago

team, is there any update on this ? is AWS planing to provide a CIS AL2 hardened EKS AMI's which can be used as a part of the cluster node group ?

shazinahmed commented 3 years ago

In case it helps, this official repo has packer scripts to create custom hardened amis.

pierluigilenoci commented 3 years ago

@mmerkes @abeer91 @heybronson is there any way to get AWS feedback on this?

mmerkes commented 3 years ago

@pierluigilenoci I'll discuss this with my team and post an update here soon.

pierluigilenoci commented 3 years ago

@mmerkes today I read this. https://aws.amazon.com/blogs/containers/introducing-cis-amazon-eks-benchmark/ So is it solved?

FYI @burnertoday

KYannick commented 3 years ago

@pierluigilenoci that blog post is about the CIS benchmark for EKS, not about the CIS benchmark for amazonlinux.

mschenk42 commented 2 years ago

Amazon can you please provide an "official" response on support for EKS Worker CIS OS Benchmark hardening. This is a pain point for many AWS customers. I find it particularly painful since AWS Inspector fails Amazon Linux II for the CIS OS Benchmark. Everyday organizations are demanding secure by default and not something we should have to jump through hoops to make work. All we want is EKS to be secure by default or at least have an option to turn on a more secure implementation.

MattTunny commented 2 years ago

is there any update on this, getting alot of customer requests for CIS level 1 for EKS, there seems to be nothing on this.

zachfeld commented 2 years ago

any update on this one? I agree with the fact that we're all looking for "secure by default" solution to this hardening issue.

blaargh commented 1 year ago

/push any news on the issue? At least an official response would be helpful.

hans-zand commented 1 year ago

I tried my lock with Image builder and CIS benchmark. it wasn't a successful try!

maiconrocha commented 6 months ago

Please note Bottlerocket AMI is now CIS hardened out of the box 🎉

Amazon Web Services’s Bottlerocket has been certified by the Center for Internet Security® (CIS®) to ship secure as hardened to CIS Bottlerocket Benchmark v1.0.0. Organizations that leverage Bottlerocket can now be assured that it will successfully run on a CIS hardened environment. https://aws.amazon.com/bottlerocket/

Please note AWS Inspector Center for Internet Security (CIS) Benchmarks reports does not support Bottlerocket yet as per https://docs.aws.amazon.com/inspector/v1/userguide/inspector_cis.html So in order to run CIS reports on Bottlerocket you need to follow https://github.com/bottlerocket-os/bottlerocket/blob/develop/sources/api/apiclient/README.md#bottlerocket-cis-benchmark-report

maiconrocha commented 2 months ago

Steps for Building Amazon Linux 2 CIS Benchmark AMIs for Amazon EKS((Level 1 and 2) are available here: https://catalog.workshops.aws/eks-security-immersionday/en-US/10-regulatory-compliance/cis-al2-eks

Specifically about the FAILED/SKIPPED checks, it has been addressed here: https://catalog.workshops.aws/eks-security-immersionday/en-US/10-regulatory-compliance/cis-al2-eks/validate-al2-cis-ami

There is a section on the bottom for "#cis-scan-results-and-exceptions-for-failed-controls" and explanation for checks that if addressed can provide Potential Operation Impact = Recommendation wasn't applied because it would have a negative effect on the service.