AWS securityhub high security documentation change
Summary
Added new control [EKS.9] requiring EKS node groups to run on supported Kubernetes versions with high severity rating
Security assessment
This change addresses security vulnerabilities by ensuring node groups receive security patches and updates. The documentation explicitly states unsupported versions may contain known vulnerabilities and lack security patches, bug fixes, and compatibility updates from AWS. The control is categorized under 'Vulnerability, patch, and version management' with high severity.
Diff
diff --git a/securityhub/latest/userguide/eks-controls.md b/securityhub/latest/userguide/eks-controls.md index 2da2aed07..94062f31a 100644 --- a//securityhub/latest/userguide/eks-controls.md +++ b//securityhub/latest/userguide/eks-controls.md @@ -5 +5 @@ -[EKS.1] EKS cluster endpoints should not be publicly accessible[EKS.2] EKS clusters should run on a supported Kubernetes version[EKS.3] EKS clusters should use encrypted Kubernetes secrets[EKS.6] EKS clusters should be tagged[EKS.7] EKS identity provider configurations should be tagged[EKS.8] EKS clusters should have audit logging enabled +[EKS.1] EKS cluster endpoints should not be publicly accessible[EKS.2] EKS clusters should run on a supported Kubernetes version[EKS.3] EKS clusters should use encrypted Kubernetes secrets[EKS.6] EKS clusters should be tagged[EKS.7] EKS identity provider configurations should be tagged[EKS.8] EKS clusters should have audit logging enabled[EKS.9] EKS node groups should run on a supported Kubernetes version @@ -180,0 +181,27 @@ To enable audit logs for your EKS cluster, see [Enabling and disabling control p +## [EKS.9] EKS node groups should run on a supported Kubernetes version + +**Category:** Identify > Vulnerability, patch, and version management + +**Severity:** High + +**Resource type:** `AWS::EKS::Nodegroup` + +**AWS Config rule:** [eks-nodegroup-supported-version-check](https://docs.aws.amazon.com/config/latest/developerguide/eks-nodegroup-supported-version-check.html) + +**Schedule type:** Change triggered + +**Parameters:** + + * `oldestVersionSupported`: `1.33` (not customizable) + + + + +This control checks whether an Amazon EKS node group runs on a supported Kubernetes version. The control fails if the EKS node group runs on an unsupported version. + +Running EKS node groups on unsupported Kubernetes versions means those nodes no longer receive security patches, bug fixes, or compatibility updates from AWS. Unsupported versions may contain known vulnerabilities that have been addressed in newer releases, and they may experience compatibility issues with updated AWS services, container images, and third-party tools in the Kubernetes ecosystem. If your application doesn't require a specific version of Kubernetes, we recommend that you use the latest available Kubernetes version that's supported by Amazon EKS for your node groups. For more information, see [Amazon EKS Kubernetes release calendar](https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-release-calendar) and [Understand each phase of node updates](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-update-behavior.html) in the __Amazon EKS User Guide__. + +### Remediation + +To update an EKS node group, see [Update a managed node group for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/update-managed-node-group.html) in the __Amazon EKS User Guide__. +