Back to Checks
aws

EKS cluster has Kubernetes secrets encryption enabled

eks_cluster_kms_cmk_encryption_in_secrets_enabled
Service: eksSeverity: medium
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:AwsEksCluster

Amazon EKS clusters configure AWS KMS envelope encryption so Kubernetes Secrets are stored in etcd as ciphertext at rest.

Prowler logoProwlerprowler-provider-aws

Risk

Without KMS-backed encryption, etcd data and snapshots can reveal plaintext secrets. Attackers with API, node, or storage access can steal tokens, passwords, and keys, enabling impersonation, pod takeover, and lateral movement-compromising confidentiality and leading to privilege escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_kms_cmk_encryption_in_secrets_enabled

Recommendation

Enable cluster-level secrets encryption with AWS KMS and prefer a customer managed KMS key for control and rotation. Apply least privilege to key policies and cluster roles, monitor key usage, and combine with strict RBAC to limit who can read or create secrets as part of defense in depth.

Remediation

CLI

aws eks associate-encryption-config --cluster-name <example_resource_name> --encryption-config '[{"resources":["secrets"],"provider":{"keyArn":"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"}}]'

Terraform

# Enable KMS envelope encryption for Kubernetes secrets
resource "aws_eks_cluster" "main" {
  name     = "<example_resource_name>"
  role_arn = "arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>"

  vpc_config {
    subnet_ids = ["<example_resource_id>", "<example_resource_id>"]
  }

  encryption_config {                 # Critical: enables KMS encryption for secrets
    resources = ["secrets"]          # Critical: scope to Kubernetes secrets
    provider {
      key_arn = "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"  # Critical: KMS key
    }
  }
}

NativeIaC

# CloudFormation: enable KMS envelope encryption for Kubernetes secrets
Resources:
  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: "<example_resource_name>"
      RoleArn: "arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>"
      ResourcesVpcConfig:
        SubnetIds:
          - "<example_resource_id>"
          - "<example_resource_id>"
      EncryptionConfig:                # Critical: enables KMS encryption for Kubernetes secrets
        - Resources:
            - secrets                  # Critical: encrypts only Kubernetes secrets
          Provider:
            KeyArn: "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"  # Critical: KMS key used for encryption

Other

1Open the AWS Management Console and go to Amazon EKS
2Select your cluster
3On the Overview tab, find Secrets encryption and click Enable
4Select the KMS key and click Enable
5Click Confirm to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_kms_cmk_encryption_in_secrets_enabled(Check):
    def execute(self):
        findings = []
        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"EKS cluster {cluster.name} does not have encryption for Kubernetes secrets."
            if cluster.encryptionConfig:
                report.status = "PASS"
                report.status_extended = (
                    f"EKS cluster {cluster.name} has encryption for Kubernetes secrets."
                )

            findings.append(report)

        return findings

References