Amazon EKS Connector considerations - Amazon EKS
AWS responsibilitiesCustomer responsibilities

Help improve this page

Want to contribute to this user guide? Scroll to the bottom of this page and select Edit this page on GitHub. Your contributions will help make our user guide better for everyone.

Amazon EKS Connector considerations

The Amazon EKS Connector is an open source component that runs on your Kubernetes cluster. This cluster can be located outside of the AWS environment. This creates additional considerations for security responsibilities. This configuration can be illustrated by the following diagram. Orange represents AWS responsibilities, and blue represents customer responsibilities:

EKS Connector Responsibilities

This topic describes the differences in the responsibility model if the connected cluster is outside of AWS.

AWS responsibilities

  • Maintaining, building, and delivering Amazon EKS Connector, which is an open source component that runs on a customer's Kubernetes cluster and communicates with AWS.

  • Maintaining transport and application layer communication security between the connected Kubernetes cluster and AWS services.

Customer responsibilities

  • Kubernetes cluster specific security, specifically along the following lines:

    • Kubernetes secrets must be properly encrypted and protected.

    • Lock down access to the eks-connector namespace.

  • Configuring role-based access control (RBAC) permissions to manage IAM principal access from AWS. For instructions, see Granting access to an IAM principal to view Kubernetes resources on a cluster.

  • Installing and upgrading Amazon EKS Connector.

  • Maintaining the hardware, software, and infrastructure that supports the connected Kubernetes cluster.

  • Securing their AWS accounts (for example, through safeguarding your root user credentials).