mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-12-20 21:58:06 +00:00
e4d6ed2e8e
* Add example IAM policy * Pass RotateKubeletServerCertificate related checks if it's not found (#767) * Allow for environment variables to be checked in tests (#755) * Initial commit for checking environment variables for etcd * Revert config changes * Remove redundant struct data * Fix issues with failing tests * Initial changes based on code review * Add option to disable envTesting + Update docs * Initial tests * Finished testing * Fix broken tests * Add a total summary and always show all tests. (#759) Whether the total summary is shown can be specified with an option. Fixes #528 Signed-off-by: Christian Zunker <christian.zunker@codecentric.cloud> * Update Readme.md file with link to Contribution guide (#754) * Update License with the year and the owner name Please add this to make your license agreement strong * Updated Readme.md file with license and proper documentation links I have added a proper license agreement to the documentation. Also shortened the links to the issues so that it does not break in any on the forks. * Update LICENSE * Update README.md * Update README.md * Remove erroneous license info Co-authored-by: Liz Rice <liz@lizrice.com> * Support auto-detect platform when running on EKS or GKE (#683) * Support auto-detect platform when running on EKS or GKE * Change to get platform name from `kubectl version` * fix regexp and add test * Update Server Version match for EKS * try to get version info from api sever at first * Refactor group skip changed group 'skip' from being a bool to be 'type' string as done in check * Change skip: true -> type: skip Co-authored-by: Huang Huang <mozillazg101@gmail.com> Co-authored-by: Wicked <jason_attwood@hotmail.co.uk> Co-authored-by: Christian Zunker <827818+czunker@users.noreply.github.com> Co-authored-by: Kaiwalya Koparkar <kaiwalyakoparkar@gmail.com> Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
57 lines
2.8 KiB
Markdown
57 lines
2.8 KiB
Markdown
# Integrating kube-bench with AWS Security Hub
|
|
|
|
You can configure kube-bench with the `--asff` to send findings to AWS Security Hub. There are some additional steps required so that kube-bench has information and permissions to send these findings.
|
|
|
|
## Enable the AWS Security Hub integration
|
|
|
|
* You will need AWS Security Hub to be enabled in your account
|
|
* In the Security Hub console, under Integrations, search for kube-bench
|
|
|
|
<p align="center">
|
|
<img src="../images/kube-bench-security-hub.png">
|
|
</p>
|
|
|
|
* Click on `Accept findings`. This gives information about the IAM permissions required to send findings to your Security Hub account. kube-bench runs within a pod on your EKS cluster, and will need to be associated with a Role that has these permissions.
|
|
|
|
## Configure permissions in an IAM Role
|
|
|
|
* Grant these permissions to the IAM Role that the kube-bench pod will be associated with. There are two potions:
|
|
* You can run the kube-bench pod under a specific [service account associated with an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) that has these permissions to write Security Hub findings.
|
|
* Alternatively the pod can be granted permissions specified by the Role that your [EKS node group uses](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html).
|
|
|
|
Here is an example IAM Policy that you can attach to your EKS node group's IAM Role:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "securityhub:BatchImportFindings",
|
|
"Resource": [
|
|
"arn:aws:securityhub:us-east-1::product/aqua-security/kube-bench"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
## Configure and rebuild kube-bench
|
|
|
|
You will need to download, build and push the kube-bench container image to your ECR repo as described in Step 3 of the [EKS instructions][eks-instructions], except that before you build the container image, you need to edit `cfg/eks-1.0/config.yaml` to specify the AWS account, AWS region, and the EKS Cluster ARN.
|
|
|
|
## Modify the job configuration
|
|
|
|
* Modify `job-eks.yaml` to specify the `--asff` flag, so that kube-bench writes output in ASFF format to Security Hub
|
|
* Make sure that `job-eks.yaml` specifies the container image you just pushed to your ECR registry.
|
|
|
|
You can now run kube-bench as a pod in your cluster: `kubectl apply -f job-eks.yaml`
|
|
|
|
Findings will be generated for any kube-bench test that generates a `[FAIL]` or `[WARN]` output. If all tests pass, no findings will be generated. However, it's recommended that you consult the pod log output to check whether any findings were generated but could not be written to Security Hub.
|
|
|
|
<p align="center">
|
|
<img src="../images/asff-example-finding.png">
|
|
</p>
|
|
|
|
[eks-instructions]: ../README.md#running-in-an-EKS-cluster
|