EKS cluster has Kubernetes secrets encryption enabled

Check ID: eks_cluster_kms_cmk_encryption_in_secrets_enabled
Provider: AWS
Service: eks
Severity: MEDIUM
Categories: encryption, cluster-security
Resource type: AwsEksCluster

What this check verifies

Amazon EKS clusters configure AWS KMS envelope encryption so Kubernetes Secrets are stored in etcd as ciphertext at rest.

Risk

Without KMS-backed encryption, etcd data and snapshots can reveal plaintext secrets. Attackers with API, node, or storage access can steal tokens, passwords, and keys, enabling impersonation, pod takeover, and lateral movement-compromising confidentiality and leading to privilege escalation.

Recommendation

Enable cluster-level secrets encryption with AWS KMS and prefer a customer managed KMS key for control and rotation. Apply least privilege to key policies and cluster roles, monitor key usage, and combine with strict RBAC to limit who can read or create secrets as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks associate-encryption-config --cluster-name <example_resource_name> --encryption-config '[{"resources":["secrets"],"provider":{"keyArn":"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"}}]'

# Enable KMS envelope encryption for Kubernetes secrets
resource "aws_eks_cluster" "main" {
  name     = "<example_resource_name>"
  role_arn = "arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>"

  vpc_config {
    subnet_ids = ["<example_resource_id>", "<example_resource_id>"]
  }

  encryption_config {                 # Critical: enables KMS encryption for secrets
    resources = ["secrets"]          # Critical: scope to Kubernetes secrets
    provider {
      key_arn = "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"  # Critical: KMS key
    }
  }
}

# CloudFormation: enable KMS envelope encryption for Kubernetes secrets
Resources:
  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: "<example_resource_name>"
      RoleArn: "arn:aws:iam::<ACCOUNT_ID>:role/<example_resource_name>"
      ResourcesVpcConfig:
        SubnetIds:
          - "<example_resource_id>"
          - "<example_resource_id>"
      EncryptionConfig:                # Critical: enables KMS encryption for Kubernetes secrets
        - Resources:
            - secrets                  # Critical: encrypts only Kubernetes secrets
          Provider:
            KeyArn: "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"  # Critical: KMS key used for encryption

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_kms_cmk_encryption_in_secrets_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster has deletion protection enabled EKS cluster has network policy enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires