Security, compliance, and hardening
View all tags
When I started, the EKS setup had the basics — workloads running, traffic flowing, deployments working. But from a security perspective, there was a lot of surface area: static AWS access keys baked into apps, default Amazon Linux nodes, no container image scanning, and a publicly accessible Kubernetes API. I hardened the stack in one month, one week at a time. Here is the journey.
When I joined as the infrastructure lead, internal tools like dashboards, databases, and monitoring were accessible over the public internet — protected only by application-level authentication. That is not good enough when you are handling sensitive data in a regulated environment. I needed a VPN solution that was easy to manage, met compliance requirements, and did not slow down the team.
Here is how I designed it using OpenVPN CloudConnexa.