CIS Kubernetes - AWS (EKS)

const cluster = new aws.eks.Cluster("cluster", {
    accessConfig: {
        authenticationMode: "API_AND_CONFIG_MAP",  // Or "API" for full EKS Access API
        bootstrapClusterCreatorAdminPermissions: false,
    },
    // ... other config
});

const cluster = new aws.eks.Cluster("cluster", {
    enabledClusterLogTypes: [
        "api",
        "audit",
        "authenticator",
        "controllerManager",
        "scheduler"
    ],
    // ... other config
});

const cluster = new aws.eks.Cluster("cluster", {
    enabledClusterLogTypes: [
        "api",
        "audit",
        "authenticator",
        "controllerManager",
        "scheduler"
    ],
    // ... other config
});

const cluster = new aws.eks.Cluster("cluster", {
    vpcConfig: {
        endpointPublicAccess: false,  // Disable public access
        endpointPrivateAccess: true,  // Enable private access
        // ... other config
    },
});

const repository = new aws.ecr.Repository("repository", {
    imageScanningConfiguration: {
        scanOnPush: true,
    },
    // ... other config
});

const repositoryPolicy = new aws.ecr.RepositoryPolicy("policy", {
    repository: repository.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Sid: "AllowPullFromSpecificRole",
            Effect: "Allow",
            Principal: {
                AWS: specificRoleArn,  // Only specific role, not "*"
            },
            Action: [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
            ],
        }],
    }),
});

// Create access entry for IAM principal
const accessEntry = new aws.eks.AccessEntry("userAccess", {
    clusterName: cluster.name,
    principalArn: userRoleArn,
    type: "STANDARD",
});

// Associate with access policy
const policyAssociation = new aws.eks.AccessPolicyAssociation("userPolicy", {
    clusterName: cluster.name,
    principalArn: userRoleArn,
    policyArn: "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy",
    accessScope: {
        type: "cluster",
    },
});

const launchTemplate = new aws.ec2.LaunchTemplate("nodeTemplate", {
    userData: pulumi.all([cluster.name]).apply(([clusterName]) => {
        const script = `#!/bin/bash
set -o xtrace
/etc/eks/bootstrap.sh ${clusterName} \\
  --kubelet-extra-args '--read-only-port=0 \\
    --anonymous-auth=false \\
    --authorization-mode=Webhook \\
    --streaming-connection-idle-timeout=5m \\
    --rotate-certificates=true'

##### Set secure file permissions
chmod 644 /var/lib/kubelet/kubeconfig
chown root:root /var/lib/kubelet/kubeconfig`;
        return Buffer.from(script).toString('base64');
    }),
});

const listener = new aws.lb.Listener("httpsListener", {
    loadBalancerArn: lb.arn,
    port: 443,
    protocol: "HTTPS",
    sslPolicy: "ELBSecurityPolicy-TLS-1-2-2017-01",
    certificateArn: certificateArn,
    defaultActions: [{
        type: "forward",
        targetGroupArn: targetGroup.arn,
    }],
});

const listener = new aws.elb.LoadBalancer("lb", {
    listeners: [{
        instancePort: 80,
        instanceProtocol: "http",
        lbPort: 443,
        lbProtocol: "https",
        sslCertificateId: certificateArn,
    }],
});

// Option 1: Enable VPC CNI Network Policy support
const addon = new aws.eks.Addon("vpc-cni", {
    clusterName: cluster.name,
    addonName: "vpc-cni",
    configurationValues: JSON.stringify({
        enableNetworkPolicy: "true",
    }),
});

// Option 2: Install Calico
const calico = new aws.eks.Addon("calico", {
    clusterName: cluster.name,
    addonName: "calico",
});

const nodeRole = new aws.iam.Role("nodeRole", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    }),
});

// Attach read-only ECR policy
new aws.iam.RolePolicyAttachment("nodeRoleEcrReadOnly", {
    role: nodeRole.name,
    policyArn: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
});

const launchTemplate = new aws.ec2.LaunchTemplate("nodeTemplate", {
    userData: pulumi.interpolate`#!/bin/bash
set -o xtrace
/etc/eks/bootstrap.sh ${cluster.name} \
  --kubelet-extra-args '--read-only-port=0 --anonymous-auth=false --authorization-mode=Webhook'
`,
});

const nodeGroup = new aws.eks.NodeGroup("nodes", {
    clusterName: cluster.name,
    launchTemplate: {
        id: launchTemplate.id,
        version: pulumi.interpolate`${launchTemplate.latestVersion}`,
    },
    // ... other config
});

const kmsKey = new aws.kms.Key("eksKmsKey", {
    description: "EKS Secret Encryption Key",
});

const cluster = new aws.eks.Cluster("cluster", {
    encryptionConfig: {
        provider: {
            keyArn: kmsKey.arn,
        },
        resources: ["secrets"],
    },
    // ... other config
});

const oidcProvider = new aws.iam.OpenIdConnectProvider("eksOidc", {
    clientIdLists: ["sts.amazonaws.com"],
    thumbprintLists: [thumbprint],
    url: cluster.identity.oidcs[0].issuer,
});

// Instead of binding cluster-admin, create specific roles
const role = new k8s.rbac.v1.Role("specificRole", {
    metadata: { namespace: "default" },
    rules: [{
        apiGroups: [""],
        resources: ["pods"],
        verbs: ["get", "list", "watch"],
    }],
});

const roleBinding = new k8s.rbac.v1.RoleBinding("specificBinding", {
    metadata: { namespace: "default" },
    roleRef: {
        apiGroup: "rbac.authorization.k8s.io",
        kind: "Role",
        name: role.metadata.name,
    },
    subjects: [{
        kind: "User",
        name: "specific-user",
    }],
});

const namespace = new k8s.core.v1.Namespace("app-namespace", {
    metadata: {
        name: "my-app",
    },
});

const deployment = new k8s.apps.v1.Deployment("app", {
    metadata: {
        namespace: namespace.metadata.name,
    },
    // ... rest of deployment spec
});

const serviceAccount = new k8s.core.v1.ServiceAccount("appServiceAccount", {
    metadata: {
        namespace: "default",
        name: "my-app-sa",
    },
});

const deployment = new k8s.apps.v1.Deployment("app", {
    spec: {
        template: {
            spec: {
                serviceAccountName: serviceAccount.metadata.name,
                // ... rest of pod spec
            },
        },
    },
});

const pod = new k8s.core.v1.Pod("pod", {
    spec: {
        containers: [{
            name: "app",
            image: "nginx",
            securityContext: {
                allowPrivilegeEscalation: false,
                runAsNonRoot: true,
                capabilities: {
                    drop: ["ALL"],
                },
            },
        }],
    },
});

const pod = new k8s.core.v1.Pod("pod", {
    spec: {
        hostIPC: false,  // Explicitly set to false or remove
        containers: [{
            name: "app",
            image: "nginx",
        }],
    },
});

const pod = new k8s.core.v1.Pod("pod", {
    spec: {
        hostNetwork: false,  // Explicitly set to false or remove
        containers: [{
            name: "app",
            image: "nginx",
        }],
    },
});

const pod = new k8s.core.v1.Pod("pod", {
    spec: {
        hostPID: false,  // Explicitly set to false or remove
        containers: [{
            name: "app",
            image: "nginx",
        }],
    },
});

const pod = new k8s.core.v1.Pod("pod", {
    spec: {
        containers: [{
            name: "app",
            image: "nginx",
            securityContext: {
                privileged: false,  // Explicitly set to false or remove
                runAsNonRoot: true,
                capabilities: {
                    drop: ["ALL"],
                },
            },
        }],
    },
});

// Bad: DON'T grant these dangerous permissions
const dangerousRole = new k8s.rbac.v1.ClusterRole("dangerous", {
    rules: [{
        apiGroups: ["rbac.authorization.k8s.io"],
        resources: ["clusterroles", "roles"],
        verbs: ["bind", "escalate"],  // DON'T DO THIS
    }, {
        apiGroups: [""],
        resources: ["users", "groups", "serviceaccounts"],
        verbs: ["impersonate"],  // DON'T DO THIS
    }],
});

// Good: Grant only necessary read permissions
const safeRole = new k8s.rbac.v1.ClusterRole("safe", {
    rules: [{
        apiGroups: ["rbac.authorization.k8s.io"],
        resources: ["clusterroles", "roles"],
        verbs: ["get", "list", "watch"],  // Read-only
    }],
});

// Good: Read-only access to pods
const podReader = new k8s.rbac.v1.Role("podReader", {
    metadata: { namespace: "default" },
    rules: [{
        apiGroups: [""],
        resources: ["pods"],
        verbs: ["get", "list", "watch"],  // Read-only
    }],
});

// Bad: Avoid granting pod creation abilities
const podCreator = new k8s.rbac.v1.Role("podCreator", {
    rules: [{
        apiGroups: [""],
        resources: ["pods", "pods/exec", "pods/attach"],
        verbs: ["create", "*"],  // DON'T DO THIS unless absolutely necessary
    }],
});

// Good: Read-only secret access
const readOnlyRole = new k8s.rbac.v1.Role("secretReader", {
    metadata: { namespace: "default" },
    rules: [{
        apiGroups: [""],
        resources: ["secrets"],
        verbs: ["get", "list", "watch"],  // Read-only access
    }],
});

// Bad: Avoid granting write access to secrets
const writeRole = new k8s.rbac.v1.Role("secretWriter", {
    rules: [{
        apiGroups: [""],
        resources: ["secrets"],
        verbs: ["*"],  // DON'T DO THIS
    }],
});

const role = new k8s.rbac.v1.Role("specificRole", {
    metadata: { namespace: "default" },
    rules: [{
        apiGroups: [""],  // Specific API group, not "*"
        resources: ["pods", "services"],  // Specific resources, not "*"
        verbs: ["get", "list", "watch"],  // Specific verbs, not "*"
    }],
});

// Bad: Using secrets as environment variables
const badPod = new k8s.core.v1.Pod("bad-pod", {
    spec: {
        containers: [{
            name: "app",
            image: "myapp:latest",
            env: [{
                name: "DB_PASSWORD",
                valueFrom: {
                    secretKeyRef: {
                        name: "db-secret",
                        key: "password",
                    },
                },
            }],
        }],
    },
});

// Good: Mount secrets as files
const goodPod = new k8s.core.v1.Pod("good-pod", {
    spec: {
        containers: [{
            name: "app",
            image: "myapp:latest",
            volumeMounts: [{
                name: "secret-volume",
                mountPath: "/etc/secrets",
                readOnly: true,
            }],
        }],
        volumes: [{
            name: "secret-volume",
            secret: {
                secretName: "db-secret",
            },
        }],
    },
});
// Access secret via: cat /etc/secrets/password

// Good: Disable auto-mounting when not needed
const pod = new k8s.core.v1.Pod("myPod", {
    metadata: { name: "my-pod" },
    spec: {
        automountServiceAccountToken: false,  // Explicitly disable
        containers: [{
            name: "app",
            image: "nginx:latest",
        }],
    },
});

// Also disable at ServiceAccount level
const sa = new k8s.core.v1.ServiceAccount("myServiceAccount", {
    metadata: { name: "my-sa" },
    automountServiceAccountToken: false,  // Disable by default
});