Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Amazon Elastic Kubernetes Service

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Kubernetes - Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...
    Group
    Show

  • Use Dedicated Service Accounts

    Kubernetes workloads should not use cluster node service accounts to authenticate to Amazon EKS APIs. Each Kubernetes workload that needs to authen...
    Rule Unknown Severity
    Show

  • Authentication

    In cloud workloads, there are many ways to create and configure to multiple authentication services. Some of these authentication methods by not be...
    Group
    Show

  • OAuth Clients Token Inactivity Timeout

    Enter OAuth Clients Token Inactivity Timeout in Seconds
    Value
    Show

  • OAuth Token Inactivity Timeout

    Enter OAuth Token Inactivity Timeout
    Value
    Show

  • Manage Users with AWS IAM

    Amazon EKS uses IAM to provide authentication to your Kubernetes cluster through the AWS IAM Authenticator for Kubernetes. You can configure the st...
    Rule Unknown Severity
    Show

  • Kubernetes - General Security Practices

    Contains evaluations for general security practices for operating a Kubernetes environment.
    Group
    Show

  • Consider Fargate for Untrusted Workloads

    It is Best Practice to restrict or fence untrusted workloads when running in a multi-tenant environment.
    Rule Unknown Severity
    Show

  • Kubernetes Kubelet Settings

    The Kubernetes Kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod. The kubelet takes a ...
    Group
    Show

  • Configure Kubelet Event Limit

    Maximum event creations per second.
    Value
    Show

  • kubelet - Authorization Options

    ABAC - Attribute-Based Access Control (ABAC) mode allows you to configure policies using local files. <br>RBAC - Role-based access control (RBAC) m...
    Value
    Show

  • Configure Kubelet EvictionHard Memory Available

    Memory Available for the EvictionHard threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionHard NodeFS Available

    Node FS Available for the EvictionHard threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionHard Node FS inodes Free

    Node FS inodes Free for the EvictionHard threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionSoft Image FS Available

    Image FS Available for the EvictionSoft threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionSoft Image FS inodes Free

    Image FS inodes Free for the EvictionSoft threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionSoft Memory Available

    Memory Available for the EvictionSoft threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionSoft NodeFS Available

    Node FS Available for the EvictionSoft threshold to trigger.
    Value
    Show

  • Configure Kubelet EvictionSoft Node FS inodes Free

    Node FS inodes Free for the EvictionSoft threshold to trigger.
    Value
    Show

  • Configure Kubelet use of the Strong Cryptographic Ciphers

    Cryptographic Ciphers Available for Kubelet, separated by comma
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules