arno
/
kube-bench
mirror of https://github.com/aquasecurity/kube-bench.git
1
0
Fork 0
Code Issues Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'c3f94dd89f'
${ noResults }
kube-bench/docs/asff.md

2.4 KiB
Raw Blame History

Integrating kube-bench with AWS Security Hub

You can configure kube-bench with the --asff to send findings to AWS Security Hub. There are some additional steps required so that kube-bench has information and permissions to send these findings.

Enable the AWS Security Hub integration

  • You will need AWS Security Hub to be enabled in your account
  • In the Security Hub console, under Integrations, search for kube-bench

  • Click on Accept findings. This gives information about the IAM permissions required to send findings to your Security Hub account. kube-bench runs within a pod on your EKS cluster, and will need to be associated with a Role that has these permissions.

Configure permissions in an IAM Role

  • Grant these permissions to the IAM Role that the kube-bench pod will be associated with. There are two potions:

Configure and rebuild kube-bench

You will need to download, build and push the kube-bench container image to your ECR repo as described in Step 3 of the EKS instructions, except that before you build the container image, you need to edit cfg/eks-1.0/config.yaml to specify the AWS account, AWS region, and the EKS Cluster ARN.

Modify the job configuration

  • Modify job-eks.yaml to specify the --asff flag, so that kube-bench writes output in ASFF format to Security Hub
  • Make sure that job-eks.yaml specifies the container image you just pushed to your ECR registry.

You can now run kube-bench as a pod in your cluster: kubectl apply -f job-eks.yaml

Findings will be generated for any kube-bench test that generates a [FAIL] or [WARN] output. If all tests pass, no findings will be generated. However, it's recommended that you consult the pod log output to check whether any findings were generated but could not be written to Security Hub.