Onboard Kubernetes Security

This topic explains onboarding options for your AWS Kubernetes clusters.

Cloud App Analyzer provides agentless discovery and detection of vulnerabilities, compliance, and configuration risks for Kubernetes components.

As part of the onboarding AWS wizard, there are two onboarding methods you can choose from to enable scanning of your AWS Kubernetes clusters:

• Manual onboarding

• Automatic onboarding

Manual onboarding

Do the following:

1. Add permissions per cluster manually. Follows steps based on your cluster authentication mode:

   When EKS API Mode is Enabled

   1. Create a new access entry with access policy:

      • AWS IAM principal: Prevasio role ARN

      • Access policy: AmazonEKSViewPolicy

   2. Download the following file: EKS API Roles YAML.

   3. In the downloaded file, replace the string <prevasio assumed role arn> with:

      arn:aws:sts::{account_id}:assumed-role/{prevasio_role_name}/AssumedRoleSession

      • Set account_id to AWS account ID (this is the onboarded to account_id).

      • Set prevasio_role_name to Prevasio IAM role name

   4. Apply the edited file to the cluster.

   When Only ConfigMap Mode is Enabled

   Do the following:

   1. Download the following script: ConfigMap Permissions Script

   2. Before you run the script:

      • Ensure you are the creator of the cluster and have network access to it.

      • Install eksctl.

      • Set the following parameters in the script:

        • CLUSTER_NAME

        • CLUSTER_REGION

        • PREVASIO_ROLE_ARN

      • If you are not running in AWS CloudShell:

        • Install aws-cli

        • Install kubectl

   3. Run the script.

2. Set public network configurations, if required

   Note: Private Networks: Clusters won't be scanned.

   For Public Networks: If the cluster has a restricted allowlist, add CIDR blocks to the allowlist:

   Region	CIDR blocks
   Prod US	3.230.68.171/32
   Prod ME	15.185.85.1/32
   	16.24.29.104/32
   	16.24.42.118/32
   Prod ANZ	13.238.234.53/32
   	52.65.218.87/32
   	54.153.142.211/32
   Prod EMEA	3.69.134.56/32
   	52.29.118.194/32
   	52.59.98.60/32
   Prod UAE	3.28.25.184/32
   	3.29.200.208/32
   	51.112.98.9/32
   Prod IND	13.234.15.109/32
   	3.108.144.76/32
   	3.109.35.125/32