EKS cluster has network policy enabled

Check ID: eks_cluster_network_policy_enabled
Provider: AWS
Service: eks
Severity: HIGH
Categories: trust-boundaries, cluster-security
Resource type: AwsEksCluster

What this check verifies

Amazon EKS clusters are evaluated for pod-level network isolation via Kubernetes NetworkPolicy, indicating whether traffic between pods and namespaces is restricted according to defined rules.

Risk

Without NetworkPolicy, pods can communicate freely, enabling lateral movement, data exfiltration, and abuse of internal services. Unrestricted east-west traffic undermines confidentiality and integrity and enlarges the blast radius of a single compromised pod.

Recommendation

Enforce least privilege NetworkPolicy with a default-deny for ingress and egress, then explicitly allow required flows by labels and namespaces. Apply defense in depth with security groups for pods and private access, and continuously test and monitor policy effectiveness.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-config --name <example_cluster_name> --resources-vpc-config securityGroupIds=<example_security_group_id>

# Minimal EKS cluster config with a security group attached
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids         = ["<example_subnet_id>"]
    security_group_ids = ["<example_security_group_id>"]  # Critical: attaches a security group to pass the check
  }
}

# CloudFormation: attach a security group to the EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_subnet_id>
        SecurityGroupIds:
          - <example_security_group_id>  # Critical: sets a security group for the cluster, satisfying the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_network_policy_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster has Kubernetes secrets encryption enabled EKS cluster endpoint is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires