Harden four layers: node, control plane, workload and network.

Each item is cheap on day one and painful to retrofit.

Node

✓IMDSv2 required, hop limit 1

✓Bottlerocket or hardened AMI

✓Minimal node IAM role

✓Patch by rolling nodes often

Control plane

✓Restricted or private endpoint

✓Access entries, API auth mode

✓Audit logs enabled

✓KMS key for Secrets

Workload

✓Pod Identity per ServiceAccount

✓Pod Security Standards enforced

✓Non-root, read-only filesystem

✓Requests, limits, PDBs

Network

✓Default-deny NetworkPolicy

✓Security groups for sensitive Pods

✓Private subnets, VPC endpoints

✓WAF on public ALBs

namespace Pod Security enforcement

kubectl label namespace shop pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/warn=restricted

Ship the checklist as code: Terraform for the cluster settings, policies for admission, and a CI check that fails when a box is unticked.

An EKS hardening checklist by layer

Security on EKS is layered. At the node layer require IMDSv2 with a hop limit of 1 so Pods cannot reach node credentials, use a minimal OS such as Bottlerocket or a hardened AMI, keep the node IAM role minimal (workloads should use their own roles), and roll nodes onto patched images regularly.

At the control plane layer restrict or privatise the API endpoint, use API authentication mode with access entries, enable control plane audit logs, and encrypt Secrets with a KMS key. At the workload layer give every ServiceAccount its own role through Pod Identity, enforce Pod Security Standards per namespace (the command shown sets the restricted level), run as non-root with a read-only root filesystem, and set resource requests, limits and PodDisruptionBudgets.

At the network layer apply default-deny NetworkPolicy, use security groups for pods for access to databases, keep nodes in private subnets with VPC endpoints, and put AWS WAF on public ALBs. Each is individually straightforward; the discipline is applying all of them consistently across clusters.

The cheapest way to be consistent is automation: encode cluster-level settings in Terraform, enforce workload rules with admission policies (Kyverno or Gatekeeper, covered in Deck 5) and add a CI check or a CIS benchmark scan such as kube-bench to catch drift.