Zeus-Labs/ZeusCloud

Add EKS security rule: EKS clusters should have encryption of K8s secrets enabled.

Opened this issue · 0 comments

  1. Follow the directions here to add the rule - https://docs.zeuscloud.io/contribute/add-security-rule

  2. Right now, the EKSCluster node doesn't have an encryptionConfig field. (https://lyft.github.io/cartography/modules/aws/schema.html#ekscluster). It should be set in cartography here (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/eks.py#L39). Test it w/ unit / integration tests

  3. The Neo4J query probably should check if encryptionConfig is not null and nonempty.

  4. Create a cdk stack (https://github.com/Zeus-Labs/ZeusCloud/blob/main/cdk/bin/cdk.ts) with an EKS cluster does / doesn't have encryption of secrets enabled. Be sure to give no IAM permissions. Don't make it public facing.

  5. Run ZeusCloud and check that the rule works correctly. You can speed up cartography running by commenting out intel modules that are run here: (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/resources.py)