Title

AWS re:Invent 2022 - Securing Kubernetes: How to address Kubernetes attack vectors (CON318)

Summary

Micah Hausler, a principal engineer at AWS, discusses securing Kubernetes and addressing attack vectors.
He shares an incident involving unauthenticated access to Kubernetes secrets due to a misconfigured role binding.
The talk covers threat modeling using the CIA (Confidentiality, Integrity, Availability) model and focuses on Kubernetes-specific threats.
Hausler discusses attack vectors and mitigations, emphasizing the importance of least privilege and secure configurations.
He highlights the OWASP top ten as a framework for understanding security vulnerabilities in Kubernetes.
The session covers security misconfigurations, outdated components, logging/monitoring failures, and server-side request forgery (SSRF).
Hausler stresses the importance of keeping clusters updated, using KMS for secret encryption, and IAM roles for service accounts.
He recommends using policy enforcement agents like Open Policy Agent or Gatekeeper and directs attendees to the EKS Security Best Practices Guide.

Kubernetes is networked by nature, which often results in high severity scores for CVEs due to the potential for network exploitation.
The principle of least privilege is crucial in Kubernetes security, particularly when configuring RBAC and IAM roles.
Security misconfigurations, such as overly permissive role bindings or unnecessary features, are common pitfalls that can lead to significant vulnerabilities.
Keeping Kubernetes components up to date is essential due to the increasing number of CVEs reported each year.
Logging and monitoring are often overlooked in security, but they are critical for detecting and responding to security incidents.
Server-side request forgery (SSRF) is a significant risk in Kubernetes, and it's essential to limit the Kubernetes API server's outbound access to prevent exploitation.
The EKS Security Best Practices Guide is a valuable resource for securing Kubernetes clusters on AWS.
Hausler's talk underscores the importance of a proactive and informed approach to Kubernetes security, leveraging AWS services and best practices to mitigate risks.