The node OS is your attack surface: pick a minimal image and lock down instance metadata.

Amazon Linux 2023

general purpose

EKS-optimized AMI, SSH or SSM access, package manager.
Easy to debug and to customise with userdata.
You patch by rolling nodes onto new AMI versions.

Bottlerocket

minimal, immutable

Container-only OS: no shell or package manager by default, read-only root.
API-driven, atomic updates; smaller attack surface.
Debug through a control or admin container.

launch template: IMDSv2 required

{
  "MetadataOptions": {
    "HttpTokens": "required",        // IMDSv2 only
    "HttpPutResponseHopLimit": 1   // pods cannot reach it
  },
  "BlockDeviceMappings": [{"DeviceName": "/dev/xvda",
     "Ebs": {"VolumeSize": 100, "VolumeType": "gp3"}}]
}

Why IMDSv2 and hop limit

Instance metadata can hand out the node role's credentials. IMDSv2 needs a session token, and a hop limit of 1 stops Pods reaching it, closing an SSRF path to AWS credentials.

Custom AMIs

Needed for compliance-hardened images or pre-baked agents. Then you own the AMI patching pipeline.

Node images: Amazon Linux or Bottlerocket, and how to harden them

By default a managed node group uses the EKS-optimized Amazon Linux AMI for your Kubernetes version. It is flexible: you can SSH or use Systems Manager, install packages and customise with userdata. Bottlerocket, AWS's purpose-built container OS, takes the opposite stance: no shell or package manager by default, an immutable root filesystem and atomic, API-driven updates. The smaller attack surface makes it a strong answer to how would you harden worker nodes, at the cost of different debugging workflows.

Independent of the OS, lock down instance metadata. The instance metadata service can return credentials of the node's IAM role. Requiring IMDSv2 (session-token based) defeats the simple SSRF attacks that worked against IMDSv1, and setting the hop limit to 1 prevents Pods from reaching the endpoint through the node's network namespace. Workloads should get AWS credentials through Pod Identity instead (Module 4).

Custom launch templates let you change disk size, userdata, metadata options and the AMI. Use a custom AMI when compliance demands a hardened baseline, but remember you now own the patch cadence for it. Auto Mode, covered shortly, takes the opposite path and removes most of these choices.

Check the current guidance: AWS has been moving towards Amazon Linux 2023 and Bottlerocket as the supported images and retiring older ones, so confirm which AMI types your Kubernetes version supports.