EKS Cluster Network Policy Not Enforced
1
1
high
What does ZopNight detect here?
Network policy enforcement on EKS is checked through the VPC CNI add-on's enableNetworkPolicy setting: an explicit false fires this $0 compliance finding, an unreadable add-on abstains. Clusters running Calico or Cilium, which require that flag off, annotate network_policy_managed_externally=true to opt out, since no third-party CNI detection signal exists yet.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-064 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Source | eks_network_policy.go |
Where it applies
The VPC CNI flag and the Calico opt-out
- Metadata network_policy_enabled (JSON bool): the authoritative signal, derived by the EKS discoverer from the VPC CNI managed add-on’s configurationValues.enableNetworkPolicy. Fires only when explicitly false; abstains when the key is absent (e.g. DescribeAddon unreadable) rather than assume misconfiguration. Not read from Tags; the rule ignores any customer-set network_policy tag.
- Metadata network_policy_managed_externally (JSON bool, operator-set opt-out): when true, the rule abstains regardless of network_policy_enabled. Exists because AWS’s supported pattern for running Calico or Cilium as the cluster’s policy engine requires enableNetworkPolicy=false on the VPC CNI add-on (the two engines conflict), so a properly-secured Calico/Cilium cluster would otherwise always false-positive here. The discoverer has no signal today to detect Calico/Cilium presence directly (no Kubernetes-API DaemonSet/namespace check, no add-on inventory for third-party CNIs), so this is a manual annotation until that producer signal lands.
A security finding, not a cost one
fixed estimate: $0/mo
Turning enforcement on and defaulting to deny
- Enable VPC CNI network policy support: update the aws-vpc-cni add-on and set enableNetworkPolicy=true in its configuration
- Alternatively, install Calico or Cilium as the cluster’s network policy enforcer (leave enableNetworkPolicy=false on the VPC CNI add-on to avoid conflicting with it), then annotate the resource with network_policy_managed_externally=true so this rule does not re-fire
- Create a default-deny NetworkPolicy in each namespace to enforce least-privilege
- Add namespace-specific allow policies for required communication paths
- Re-run discovery to confirm enforcement is detected