# Cis Eks V180 5.4.4

> Ensure AmazonEKSNetworkingPolicy is Enabled and set as appropriate (Automated)

- Skill: `cyberstrikeus/cis-eks-v180-5-4-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-eks-v180-5-4-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-eks-v180-5-4-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-eks-v180-5-4-4

---


# 5.4.4 Ensure AmazonEKSNetworkingPolicy is Enabled and set as appropriate (Automated)

## Profile Applicability

- Level 1

## Description

**AmazonEKSNetworkingPolicy** is an AWS-managed add-on that provides native support for Kubernetes NetworkPolicy enforcement within Amazon Elastic Kubernetes Service (EKS) clusters. It enables organizations to define and apply fine-grained, pod-level network access controls that regulate traffic between workloads and external endpoints. Built on an AWS-optimized implementation of Calico, the add-on integrates seamlessly with the EKS control plane to deliver a secure and scalable approach to network segmentation without requiring manual CNI plugin installation.

## Rationale

By default, all pod to pod traffic within a cluster is allowed. Network Policy creates a pod-level firewall that can be used to restrict traffic between sources. Implementing AmazonEKSNetworkingPolicy provides significant security and operational benefits by introducing native, AWS-managed enforcement of Kubernetes NetworkPolicies, enabling fine-grained pod-level network segmentation and reducing the risk of lateral movement.

## Impact

Enabling Network Policy enforcement consumes additional resources in nodes. Specifically, it increases the memory footprint of the kube-system process by approximately 128MB, and requires approximately 300 millicores of CPU.

## Audit Procedure

```bash
export CLUSTER_NAME=<your cluster name>
aws eks describe-addon --cluster-name ${CLUSTER_NAME} --addon-name vpc-cni --query addon.configurationValues
```

Output should read: `"{\"enableNetworkPolicy\":\"true\"}"`

## Remediation

Make sure Amazon VPC CNI is added and vpc-cni is active and upgraded to appropriate version in clusters Add-Ons:

```bash
aws eks update-addon --cluster-name $CLUSTER_NAME --addon-name vpc-cni --configuration-values '{"enableNetworkPolicy":"true"}'
```

## Default Value

By default, Network Policy is disabled.

## References

1. https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html

## CIS Controls

| Controls Version | Control                                       | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------- | ---- | ---- | ---- |
| v8               | 13.1 Centralize Security Event Alerting       |      | ●    | ●    |
| v7               | 14.1 Segment the Network Based on Sensitivity |      |      | ●    |

## Profile Applicability

- Level 1