eks-secrets-encrypted
Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys.
This rule is COMPLIANT if an EKS cluster has an encryptionConfig with secrets as one of the resources.
This rule is also COMPLIANT if the key used to encrypt EKS secrets matches with the parameter.
This rule is NON_COMPLIANT if an EKS cluster does not have an encryptionConfig or if the encryptionConfig resources do not include secrets.
This rule is also NON_COMPLIANT if the key used to encrypt EKS secrets does not match with the parameter.
Identifier: EKS_SECRETS_ENCRYPTED
Resource Types: AWS::EKS::Cluster
Trigger type: Periodic
AWS Region: All supported AWS regions except US ISO West (Northern California), Asia Pacific (Malaysia), Canada West (Calgary) Region
Parameters:
- kmsKeyArns (Optional)
- Type: CSV
-
Comma separated list of Amazon Resource Name (ARN) of the KMS key that should be used for encrypted secrets in an EKS cluster.
AWS CloudFormation template
To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.
