Cis Eks V180 5.4.4

5.4.4 Ensure AmazonEKSNetworkingPolicy is Enabled and set as appropriate (Automated)

Profile Applicability

• Level 1

Description

AmazonEKSNetworkingPolicy is an AWS-managed add-on that provides native support for Kubernetes NetworkPolicy enforcement within Amazon Elastic Kubernetes Service (EKS) clusters. It enables organizations to define and apply fine-grained, pod-level network access controls that regulate traffic between workloads and external endpoints. Built on an AWS-optimized implementation of Calico, the add-on integrates seamlessly with the EKS control plane to deliver a secure and scalable approach to network segmentation without requiring manual CNI plugin installation.

Rationale

By default, all pod to pod traffic within a cluster is allowed. Network Policy creates a pod-level firewall that can be used to restrict traffic between sources. Implementing AmazonEKSNetworkingPolicy provides significant security and operational benefits by introducing native, AWS-managed enforcement of Kubernetes NetworkPolicies, enabling fine-grained pod-level network segmentation and reducing the risk of lateral movement.

Impact

Enabling Network Policy enforcement consumes additional resources in nodes. Specifically, it increases the memory footprint of the kube-system process by approximately 128MB, and requires approximately 300 millicores of CPU.

Audit Procedure

export CLUSTER_NAME=<your cluster name>
aws eks describe-addon --cluster-name ${CLUSTER_NAME} --addon-name vpc-cni --query addon.configurationValues

Output should read: "{\"enableNetworkPolicy\":\"true\"}"

Remediation

Make sure Amazon VPC CNI is added and vpc-cni is active and upgraded to appropriate version in clusters Add-Ons:

aws eks update-addon --cluster-name $CLUSTER_NAME --addon-name vpc-cni --configuration-values '{"enableNetworkPolicy":"true"}'

Default Value

By default, Network Policy is disabled.

References

1. https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html

CIS Controls

Profile Applicability

• Level 1