EKS Security Hardening Guide
Amazon EKS clusters को secure करने का layered approach — node OS से CI/CD pipeline तक।
Layers
EKS security एक single setting नहीं है। यह layers का stack है, हर एक अलग attack surface address करता है:
┌─────────────────────────────────┐
│ CI/CD Pipeline │ ← SonarCloud, Trivy, branch protection
├─────────────────────────────────┤
│ Pod Security │ ← IRSA, Pod Identity, secrets management
├─────────────────────────────────┤
│ Network Security │ ← Private API, WAF, security groups
├─────────────────────────────────┤
│ Node Security │ ← Bottlerocket, no SSH, AMI management
├─────────────────────────────────┤
│ Cluster Management │ ← Upgrades, addon versions, monitoring
└─────────────────────────────────┘
नीचे (nodes) से शुरू करो और ऊपर जाओ। हर layer नीचे वाली पर build होती है।
Guides
| Guide | क्या cover करता है |
|---|---|
| Node Security | Bottlerocket OS, no SSH, AMI management, node refresh |
| Pod Security | IRSA, Pod Identity Agent, secrets management, access keys से migration |
| Network Security | Private API endpoint, VPN-only kubectl, security groups, WAF |
| CI/CD Security | SonarCloud, Trivy scanning, Quality Gates, branch protection |
| Cluster Upgrades | EKS version upgrades, addon compatibility, rollout strategy |
Priority Order
अगर scratch से शुरू कर रहे हो, इस order में tackle करो:
- Bottlerocket (node security) — single change, host-level attack surface पर biggest impact
- Private API endpoint (network) — cluster को internet से हटाता है
- IRSA (pod security) — static credentials eliminate करता है
- SonarCloud + Trivy (CI/CD) — ship होने से पहले vulnerabilities पकड़ता है
- Cluster upgrades (management) — security patches पर current रहो