Amazon-eks-ami: Can we implement EKS-AMI hardening?

[khetanvallurupalli]

As per Our Infosec team, Every server should be using Hardened AMI according to there policies.
While we do the same for EKS AMI worker nodes are terminated before starting. Any suggestions?

[rickard-von-essen]

Did you check why?

[khetanvallurupalli]

As there AMI has passed the CIS benchmark test. with some agents like Splunk and TrendMicro are Baked into it. As we scanned the Base EKS AMI for CIS benchmarks it got 58%. So we need to go with EKS-AMI hardening where it fails to launch a worker node.

[micahhausler]

@khetanvallurupalli We have an issue (#99) for CIS benchmarks, would that cover your use case or are there additional changes?

[pthrasher]

it may not be accurate... but I believe there's sort of 2 levels here. Linux ami hardening, and then kube hardening. Both with separate benchmarks from CIS.

[burnertoday]

@pthrasher I believe you are correct:

Kubenetes hardening: CIS_Kubernetes_Benchmark_v1.4.1.pdf
AMI Hardening: CIS_Amazon_Linux_Benchmark_v2.1.0.pdf

There is no specific and official CIS hardened AMI for EKS that I can find. If anyone else can please point us.

[hawkesnc]

Hi everyone,
Looking for some direction here. Is this on AWS' roadmap? I'm currently looking at trying to harden the AMI myself (specifically the linux AMI hardening) but if the work is already being done then that's great. Otherwise, I'm willing to open a PR but I would like some direction the preferred approach.

[yatintaluja]

Looking for aws hardened image, what are the options available currently.

[hawkesnc]

Looking for aws hardened image, what are the options available currently.

Nothing official from AWS that I can find, but there are python/ansible scripts that you can search up on Github that are unofficial

[KYannick]

Does anyone has an idea what the status is of this issue? Are there plans to provide hardened images for EKS?

[peteroruba]

I am surprised this receives so little attention.

[Gangaram-Dewasi]

team, is there any update on this ? is AWS planing to provide a CIS AL2 hardened EKS AMI's which can be used as a part of the cluster node group ?

[shazinahmed]

In case it helps, this official repo has packer scripts to create custom hardened amis.

[pierluigilenoci]

@mmerkes @abeer91 @heybronson is there any way to get AWS feedback on this?

[mmerkes]

@pierluigilenoci I'll discuss this with my team and post an update here soon.

[pierluigilenoci]

@mmerkes today I read this. https://aws.amazon.com/blogs/containers/introducing-cis-amazon-eks-benchmark/ So is it solved?

FYI @burnertoday

[KYannick]

@pierluigilenoci that blog post is about the CIS benchmark for EKS, not about the CIS benchmark for amazonlinux.