cis-eks-v180-5-4-4

name	cis-eks-v180-5.4.4
description	Ensure AmazonEKSNetworkingPolicy is Enabled and set as appropriate (Automated)
category	cis-eks
version	1.8.0
author	cyberstrike-official
tags	["cis","eks","kubernetes","aws","networking","network-policy","calico","zero-trust"]
cis_id	5.4.4
cis_benchmark	CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.8.0
tech_stack	["kubernetes","aws","eks"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.4.4 Ensure AmazonEKSNetworkingPolicy is Enabled and set as appropriate (Automated)

Profile Applicability

• Level 1

Description

AmazonEKSNetworkingPolicy is an AWS-managed add-on that provides native support for Kubernetes NetworkPolicy enforcement within Amazon Elastic Kubernetes Service (EKS) clusters. It enables organizations to define and apply fine-grained, pod-level network access controls that regulate traffic between workloads and external endpoints. Built on an AWS-optimized implementation of Calico, the add-on integrates seamlessly with the EKS control plane to deliver a secure and scalable approach to network segmentation without requiring manual CNI plugin installation.

Rationale

By default, all pod to pod traffic within a cluster is allowed. Network Policy creates a pod-level firewall that can be used to restrict traffic between sources. Implementing AmazonEKSNetworkingPolicy provides significant security and operational benefits by introducing native, AWS-managed enforcement of Kubernetes NetworkPolicies, enabling fine-grained pod-level network segmentation and reducing the risk of lateral movement.

Impact

Enabling Network Policy enforcement consumes additional resources in nodes. Specifically, it increases the memory footprint of the kube-system process by approximately 128MB, and requires approximately 300 millicores of CPU.

Audit Procedure

export CLUSTER_NAME=<your cluster name>
aws eks describe-addon --cluster-name ${CLUSTER_NAME} --addon-name vpc-cni --query addon.configurationValues

Output should read: "{\"enableNetworkPolicy\":\"true\"}"

Remediation

Make sure Amazon VPC CNI is added and vpc-cni is active and upgraded to appropriate version in clusters Add-Ons:

aws eks update-addon --cluster-name $CLUSTER_NAME --addon-name vpc-cni --configuration-values '{"enableNetworkPolicy":"true"}'

Default Value

By default, Network Policy is disabled.

References

1. https://docs.aws.amazon.com/eks/latest/userguide/eks-networking-add-ons.html

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	13.1 Centralize Security Event Alerting