Lab 01 — Secure Amazon EKS

Mission Information

Item	Details
Lab ID	AWS-EKS-SEC-LAB-01
Difficulty	Intermediate
Estimated Time	4–6 Hours
AWS Services	Amazon EKS, IAM, EC2, VPC, CloudWatch, CloudTrail, KMS, ECR
Platform	AWS
Cost	AWS Free Tier Not Applicable (Charges May Apply)
Primary Role	Cloud Security Engineer
Supporting Roles	Platform Engineer, DevSecOps Engineer, Kubernetes Administrator
Module	Amazon EKS Security
Previous Lesson	Amazon EKS Architecture
Next Lab	Lab 02 — Secure Worker Nodes

Mission Scenario

CloudNova Technologies is modernising its application platform by migrating containerised workloads from self-managed Kubernetes clusters to Amazon Elastic Kubernetes Service (Amazon EKS).

The organisation requires every EKS cluster to follow enterprise security standards before any applications can be deployed.

The Cloud Security team has been tasked with designing and implementing a secure Amazon EKS environment that satisfies organisational security, compliance, and governance requirements.

You have been assigned as the Cloud Security Engineer responsible for deploying and securing the organisation’s first production-ready EKS cluster.

Your mission is to deploy an Amazon EKS cluster and implement security controls including:

Secure IAM
Private networking
Kubernetes RBAC
Encryption
Logging
Monitoring
Least privilege
Secure container registry integration
Cluster governance

Learning Objectives

By completing this lab, you will learn how to:

Deploy an Amazon EKS cluster securely
Configure IAM Roles for EKS
Implement least-privilege access
Secure Kubernetes API access
Enable control plane logging
Configure KMS encryption
Secure worker nodes
Integrate Amazon ECR
Configure CloudWatch monitoring
Review CloudTrail activity
Enable GuardDuty EKS Protection
Validate Kubernetes RBAC
Review cluster networking
Apply enterprise security best practices

Enterprise Architecture

                     AWS Organization

                            │

                            ▼

                    AWS Production Account

                            │

                            ▼

                        Amazon VPC

      ┌─────────────────────────────────────────────┐

      │ Public Subnets                              │

      │ • NAT Gateway                               │

      │ • Load Balancers                            │

      └─────────────────────────────────────────────┘

      ┌─────────────────────────────────────────────┐

      │ Private Subnets                             │

      │                                             │

      │ Amazon EKS Control Plane                    │

      │ Worker Nodes                               │

      │ Kubernetes Pods                            │

      └─────────────────────────────────────────────┘

                 │                     │

                 ▼                     ▼

            Amazon ECR           CloudWatch

                 │                     │

                 └──────────► CloudTrail

                            │

                            ▼

                       AWS KMS Keys

                            │

                            ▼

                     Amazon GuardDuty

Lab Outcomes

After completing this lab, you will have:

Created a secure Amazon EKS cluster
Configured IAM authentication
Enabled audit logging
Configured KMS encryption
Enabled CloudTrail logging
Integrated CloudWatch monitoring
Enabled GuardDuty protection
Connected Amazon ECR securely
Applied Kubernetes RBAC
Validated security controls

Security Notice

This lab provisions AWS infrastructure that may incur charges.

Always:

Use an authorised AWS account
Deploy resources in approved regions
Delete resources after completing the lab
Never use production AWS accounts for training
Protect AWS credentials

Prerequisites

Before starting, ensure you have:

AWS Account
AWS CLI configured
kubectl installed
eksctl installed
IAM administrative permissions
Docker installed
VS Code
Git Bash or PowerShell

Tools Used

Tool	Purpose
AWS CLI	AWS administration
eksctl	Create EKS clusters
kubectl	Kubernetes administration
IAM	Identity management
CloudWatch	Monitoring
CloudTrail	Audit logging
GuardDuty	Threat detection
KMS	Encryption
Amazon ECR	Container registry

Recommended Folder Structure

lab-01-secure-amazon-eks/

├── manifests/
├── iam/
├── logging/
├── monitoring/
├── evidence/
├── reports/
└── screenshots/

Task 01 — Configure AWS CLI

Verify credentials.

aws sts get-caller-identity

Record:

AWS Account ID
IAM User or Role
Region

Save the output in:

evidence/aws-identity.txt

Task 02 — Verify Prerequisites

Check:

aws --version

kubectl version --client

eksctl version

Record versions.

Task 03 — Create a Dedicated VPC

Review:

CIDR
Public subnets
Private subnets
Availability Zones

Validate:

Route Tables
Internet Gateway
NAT Gateway

Task 04 — Create Amazon EKS Cluster

Example:

eksctl create cluster \
--name ghc-secure-eks \
--region ap-south-1 \
--version 1.30

Monitor cluster creation.

Task 05 — Validate Cluster

kubectl get nodes

Verify:

Worker nodes Ready
Kubernetes version
Node roles

Task 06 — Review IAM Roles

Review:

Cluster IAM Role
Node IAM Role
IAM Policies

Confirm:

Least privilege
No wildcard permissions
AWS managed policies only where appropriate

Task 07 — Enable Control Plane Logging

Enable:

API
Audit
Authenticator
Scheduler
Controller Manager

Validate logs in:

CloudWatch Logs

Task 08 — Enable Secrets Encryption

Create a KMS key.

Associate the key with the cluster.

Validate:

Secrets encrypted at rest
KMS permissions

Task 09 — Configure kubectl Access

Update kubeconfig.

aws eks update-kubeconfig \
--name ghc-secure-eks

Verify:

kubectl cluster-info

Task 10 — Review Kubernetes RBAC

List ClusterRoles.

kubectl get clusterroles

List ClusterRoleBindings.

kubectl get clusterrolebindings

Identify:

cluster-admin users
Excessive permissions

Task 11 — Configure Namespace Security

Create namespaces.

Apply:

Labels
ResourceQuotas
LimitRanges

Validate namespace isolation.

Task 12 — Enable Amazon GuardDuty EKS Protection

Enable:

GuardDuty
Runtime Monitoring
Audit Log Protection

Review findings.

Task 13 — Configure Amazon ECR

Create repository.

Review:

Repository policy
Image scanning
Immutable tags

Push a sample image.

Task 14 — Deploy Test Application

Deploy:

nginx

Verify:

kubectl get pods

Confirm:

Running
Healthy

Task 15 — Review Networking

Review:

VPC
Security Groups
NACLs
Private Subnets
Cluster Endpoint

Confirm:

Least privilege
No unnecessary public exposure

Task 16 — Review Security Groups

Validate inbound rules.

Validate outbound rules.

Ensure:

No unrestricted administrative access
Only approved ports

Task 17 — Review Cluster Endpoint Access

Determine whether:

Public endpoint enabled
Private endpoint enabled

Recommend:

Private endpoint with restricted public CIDRs where operationally feasible.

Task 18 — Enable CloudTrail

Verify CloudTrail captures:

EKS API
IAM
EC2
KMS
ECR

Save evidence.

Task 19 — Configure CloudWatch Monitoring

Review:

Metrics
Container Insights
Cluster health

Create basic alarms.

Task 20 — Review Worker Nodes

Validate:

Managed Node Group
Latest AMI
Security patches
IAM role
Security Groups

Task 21 — Validate Kubernetes Authentication

Run:

kubectl auth can-i get pods

Test:

Allowed access
Denied access

Task 22 — Review Amazon EKS Best Practices

Validate:

IAM Roles
Private Networking
Logging
Encryption
Monitoring
Image Security
Least Privilege

Task 23 — Collect Evidence

Collect:

Cluster details
IAM Roles
CloudTrail screenshots
CloudWatch screenshots
GuardDuty findings
kubectl outputs
EKS configuration
Security Groups
KMS configuration

Task 24 — Create Security Report

Document:

Cluster configuration
Security controls
Risks
Recommendations
Compliance status

Task 25 — Clean Up Resources

Delete the cluster.

eksctl delete cluster \
--name ghc-secure-eks

Verify all AWS resources have been removed.

Enterprise Security Checklist

Control	Status
Secure EKS cluster deployed	☐
IAM least privilege implemented	☐
Kubernetes RBAC reviewed	☐
Control plane logging enabled	☐
CloudTrail enabled	☐
CloudWatch configured	☐
GuardDuty enabled	☐
KMS encryption enabled	☐
Secure networking validated	☐
Amazon ECR configured	☐
Namespace isolation configured	☐
Worker nodes reviewed	☐
Security Groups reviewed	☐
Cluster endpoint secured	☐
Evidence collected	☐
Final report completed	☐

Risk Classification

Critical

Publicly exposed Kubernetes API
Unrestricted IAM permissions
No audit logging
Secrets not encrypted

High

Public worker nodes
Excessive RBAC permissions
Missing GuardDuty protection
Missing image scanning

Medium

Missing monitoring
Weak namespace governance
Missing alarms

Low

Documentation updates
Resource tagging improvements

Skills Developed

By completing this lab, you will be able to:

Deploy secure Amazon EKS clusters
Configure IAM authentication
Implement Kubernetes RBAC
Secure EKS networking
Configure KMS encryption
Enable audit logging
Monitor EKS using CloudWatch
Integrate Amazon ECR
Review GuardDuty findings
Perform enterprise Kubernetes security validation

Knowledge Check

Question 1

Why should EKS worker nodes be deployed in private subnets?

Answer: To reduce internet exposure and improve the security posture of the Kubernetes environment.

Question 2

Why is IAM Roles for Service Accounts (IRSA) preferred over static AWS credentials?

Answer: IRSA provides temporary, least-privilege credentials without storing long-lived secrets inside Kubernetes.

Question 3

Why should Amazon EKS control plane logging be enabled?

Answer: It provides audit visibility into authentication, API activity, and cluster operations for security monitoring and investigations.

Question 4

What is the purpose of enabling KMS encryption for EKS Secrets?

Answer: It encrypts Kubernetes Secrets at rest using AWS Key Management Service, helping protect sensitive data.

Question 5

Why should CloudTrail and GuardDuty be enabled for Amazon EKS?

Answer: CloudTrail records API activity, while GuardDuty analyses logs and events to detect suspicious or malicious behaviour.

Lab Summary

In this lab, you securely deployed and configured an Amazon EKS cluster following AWS and Kubernetes security best practices.

You implemented:

Secure cluster deployment
IAM least privilege
Kubernetes RBAC
Control plane logging
KMS encryption
CloudTrail auditing
CloudWatch monitoring
GuardDuty protection
Secure networking
Amazon ECR integration

These controls establish a secure foundation for running enterprise Kubernetes workloads on AWS while supporting operational visibility, compliance, and governance.

What’s Next?

Next Lab: Lab 02 — Secure Amazon EKS Worker Nodes

In the next lab, you will harden Amazon EKS worker nodes by implementing secure AMIs, node IAM roles, bootstrap security, patch management, node isolation, runtime protection, and enterprise node governance.