EKS security architecture

Security is a chain from human identity to build, registry, admission, runtime, network, data, and evidence.

Prevent

• Use federated short-lived human access and least-privilege RBAC.
• Give Pods scoped identity with Pod Identity or IRSA.
• Keep nodes private and restrict the API endpoint.
• Enforce Pod Security standards and safe security contexts.
• Use default-deny network policy and narrow security groups.
• Encrypt data with appropriate KMS controls and rotate secrets.
• Scan ECR images with Amazon Inspector and deploy immutable digests.
• Use admission policy to reject privileged, unsigned, unapproved, or incorrectly configured workloads.

Detect

Enable useful EKS control-plane logs: API, audit, authenticator, controller manager, and scheduler according to need. Centralize CloudTrail. GuardDuty EKS Protection can analyze audit activity and runtime signals where enabled. Security Hub aggregates supported findings. CloudWatch and SIEM rules need owners and response playbooks.

Respond

Preserve evidence, isolate the workload, revoke identity, rotate secrets, replace compromised nodes, redeploy known-good images, and test recovery. Do not debug a compromised node back into production.

Feynman check

The cluster is a building. IAM is the gate, RBAC is room access, network policy is the hallway rule, image admission checks deliveries, and logs are cameras. One lock is not a security architecture.