Back to Checks
aws

EKS cluster has network policy enabled

eks_cluster_network_policy_enabled
Service: eksSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariescluster-security
Resource Type:AwsEksCluster

Amazon EKS clusters are evaluated for pod-level network isolation via Kubernetes NetworkPolicy, indicating whether traffic between pods and namespaces is restricted according to defined rules.

Prowler logoProwlerprowler-provider-aws

Risk

Without NetworkPolicy, pods can communicate freely, enabling lateral movement, data exfiltration, and abuse of internal services. Unrestricted east-west traffic undermines confidentiality and integrity and enlarges the blast radius of a single compromised pod.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_network_policy_enabled

Recommendation

Enforce least privilege NetworkPolicy with a default-deny for ingress and egress, then explicitly allow required flows by labels and namespaces. Apply defense in depth with security groups for pods and private access, and continuously test and monitor policy effectiveness.

Remediation

CLI

aws eks update-cluster-config --name <example_cluster_name> --resources-vpc-config securityGroupIds=<example_security_group_id>

Terraform

# Minimal EKS cluster config with a security group attached
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids         = ["<example_subnet_id>"]
    security_group_ids = ["<example_security_group_id>"]  # Critical: attaches a security group to pass the check
  }
}

NativeIaC

# CloudFormation: attach a security group to the EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_subnet_id>
        SecurityGroupIds:
          - <example_security_group_id>  # Critical: sets a security group for the cluster, satisfying the check

Other

1Open the AWS Console and go to EKS > Clusters
2Select <your cluster> and open the Networking tab
3Click Edit (or Update) in the Networking section
4Under Security groups, add/select <example_security_group_id>
5Click Save to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_network_policy_enabled(Check):
    def execute(self):
        findings = []
        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"EKS cluster {cluster.name} does not have a Network Policy. Cluster security group ID is not set."
            if cluster.security_group_id:
                report.status = "PASS"
                report.status_extended = f"EKS cluster {cluster.name} has a Network Policy with the security group {cluster.security_group_id}."

            findings.append(report)

        return findings

References