Add EKS security rule: EKS clusters should have encryption of K8s secrets enabled.
Opened this issue · 0 comments
-
Follow the directions here to add the rule - https://docs.zeuscloud.io/contribute/add-security-rule
-
Right now, the EKSCluster node doesn't have an
encryptionConfig
field. (https://lyft.github.io/cartography/modules/aws/schema.html#ekscluster). It should be set in cartography here (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/eks.py#L39). Test it w/ unit / integration tests -
The Neo4J query probably should check if encryptionConfig is not null and nonempty.
-
Create a cdk stack (https://github.com/Zeus-Labs/ZeusCloud/blob/main/cdk/bin/cdk.ts) with an EKS cluster does / doesn't have encryption of secrets enabled. Be sure to give no IAM permissions. Don't make it public facing.
-
Run ZeusCloud and check that the rule works correctly. You can speed up cartography running by commenting out intel modules that are run here: (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/resources.py)