eks-secrets-encrypted - Amazon Config
Amazon CloudFormation template
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

eks-secrets-encrypted

Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using Amazon Key Management Service (KMS) keys.

  • This rule is COMPLIANT if an EKS cluster has an encryptionConfig with secrets as one of the resources.

  • This rule is also COMPLIANT if the key used to encrypt EKS secrets matches with the parameter.

  • This rule is NON_COMPLIANT if an EKS cluster does not have an encryptionConfig or if the encryptionConfig resources do not include secrets.

  • This rule is also NON_COMPLIANT if the key used to encrypt EKS secrets does not match with the parameter.

Identifier: EKS_SECRETS_ENCRYPTED

Resource Types: AWS::EKS::Cluster

Trigger type: Periodic

Amazon Web Services Region: All supported Amazon regions except Canada West (Calgary) Region

Parameters:

kmsKeyArns (Optional)
Type: CSV

Comma separated list of Amazon Resource Name (ARN) of the KMS key that should be used for encrypted secrets in an EKS cluster.

Amazon CloudFormation template

To create Amazon Config managed rules with Amazon CloudFormation templates, see Creating Amazon Config Managed Rules With Amazon CloudFormation Templates.