AWS EKS cluster does not have secrets encryption enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_58
Category - Subcategory	Kubernetes - Native Security Controls
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	1282a39f-806b-404e-bd79-15e463c5472f

Impact

This rule identifies AWS EKS clusters that do not have secrets encryption enabled. AWS EKS cluster secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with direct access to etcd or with API access can retrieve or modify the secrets. Using secrets encryption for your Amazon EKS cluster allows you to protect sensitive information such as passwords and API keys using Kubernetes-native APIs. It is recommended to enable secrets encryption to ensure its security and reduce the risk of unauthorized access or data breaches.

How to Fix

Resource: AWS::EKS::Cluster

• Argument: Properties.EncryptionConfig.Resources.secrets [source,go]

---

{ "Resources: myCluster: Type: 'AWS::EKS::Cluster' Properties: ... EncryptionConfig:

• Resources:
• • secrets", }

---