# EKS Cluster Network Policy Not Enforced

> Network policy enforcement on EKS is checked through the VPC CNI add-on's enableNetworkPolicy setting: an explicit false fires this $0 compliance finding, an unreadable add-on abstains. Clusters running Calico or Cilium, which require that flag off, annotate network_policy_managed_externally=true to opt out, since no third-party CNI detection signal exists yet.

Source: https://zop.dev/integrations/aws/recommendations/eks-cluster-network-policy-not-enforced
Updated: 2026-08-19

---

## The VPC CNI flag and the Calico opt-out

- Metadata network_policy_enabled (JSON bool): the authoritative signal, derived by the EKS discoverer from the VPC CNI managed add-on's configurationValues.enableNetworkPolicy. Fires only when explicitly false; abstains when the key is absent (e.g. DescribeAddon unreadable) rather than assume misconfiguration. Not read from Tags; the rule ignores any customer-set network_policy tag.
- Metadata network_policy_managed_externally (JSON bool, operator-set opt-out): when true, the rule abstains regardless of network_policy_enabled. Exists because AWS's supported pattern for running Calico or Cilium as the cluster's policy engine requires enableNetworkPolicy=false on the VPC CNI add-on (the two engines conflict), so a properly-secured Calico/Cilium cluster would otherwise always false-positive here. The discoverer has no signal today to detect Calico/Cilium presence directly (no Kubernetes-API DaemonSet/namespace check, no add-on inventory for third-party CNIs), so this is a manual annotation until that producer signal lands.

## A security finding, not a cost one

fixed estimate: $0/mo

## Turning enforcement on and defaulting to deny

1. Enable VPC CNI network policy support: update the aws-vpc-cni add-on and set enableNetworkPolicy=true in its configuration
2. Alternatively, install Calico or Cilium as the cluster's network policy enforcer (leave enableNetworkPolicy=false on the VPC CNI add-on to avoid conflicting with it), then annotate the resource with network_policy_managed_externally=true so this rule does not re-fire
3. Create a default-deny NetworkPolicy in each namespace to enforce least-privilege
4. Add namespace-specific allow policies for required communication paths
5. Re-run discovery to confirm enforcement is detected