EKS interview question · Most asked
How do you secure an EKS cluster end to end?
Summary
Layer controls: IAM-based access with access entries and least-privilege RBAC; Pod Identity or IRSA for workloads (not node roles); private or restricted API endpoint; Pod Security Standards and a policy engine; NetworkPolicies (the VPC CNI supports them) or security groups for pods; encryption of secrets with KMS; image scanning and only trusted registries (ECR); audit logging; and GuardDuty EKS protection for threat detection.
Longer Answer
Node-level hardening: use EKS-optimized or Bottlerocket AMIs and keep them patched, require IMDSv2 with hop limit 1 so pods cannot steal node credentials, avoid SSH (use SSM), and run nodes in private subnets. Supply chain: scan images in ECR (enhanced scanning with Inspector), sign images, and enforce signatures at admission. Detect and respond: control-plane audit logs to CloudWatch, GuardDuty runtime monitoring, and alerts on privileged pod creation or unexpected RBAC changes.
Key Points
- IAM + RBAC least privilege.
- Workload identity; IMDSv2 hop limit 1.
- Pod security, NetworkPolicies, KMS secrets.
- Scanning, signing, audit logs, GuardDuty.
More most-asked EKS questions
- What is Amazon EKS, and what does AWS manage versus what do you manage?
- Compare the EKS compute options: managed node groups, self-managed nodes, Fargate, Karpenter and EKS Auto Mode.
- How does the Amazon VPC CNI work, and why do EKS clusters run out of IP addresses?
- IRSA or EKS Pod Identity: how do pods get AWS permissions?
- How do you expose services on EKS? Explain the AWS Load Balancer Controller.
- How do you upgrade an EKS cluster, and what are standard and extended support?
- Why is Karpenter popular on EKS, and how does it differ from the Cluster Autoscaler?
- EKS or ECS: how would you choose?