Kubernetes STIG Baseline EKS Overlay
Developed a Chef InSpec overlay for applying the DISA Kubernetes STIG to Amazon EKS, with EKS-specific inputs, helper resources, and documented managed-control-plane exemptions.
EKS-aware controls • Managed-service exemptions • Automated evidence
The Challenge
The upstream Kubernetes STIG assumes access to control-plane components that AWS manages in EKS. Applying the baseline unchanged can create checks that cannot be evaluated by a customer and findings that do not reflect the shared-responsibility model.
The Solution
Built a Chef InSpec overlay that preserves the DISA Kubernetes STIG baseline while adding EKS-specific inputs, reusable helper resources, and documented exemptions for AWS-managed control-plane components.
Architecture
Implementation Process
Mapped baseline checks to the parts of EKS visible to the customer
Added EKS-specific inputs and helper resources for portable control logic
Inherited applicable upstream controls instead of copying the full baseline
Documented exemptions where AWS owns the managed control-plane implementation
Results & Impact
Made Kubernetes STIG assessment practical for Amazon EKS environments
Kept applicable controls aligned with the upstream baseline through an overlay model
Separated actionable findings from documented managed-service responsibilities
Published the profile and its usage guidance as an open-source repository