AWS details protocol security gaps in multi-tenant Kubernetes clusters
AWS says some common protocols send traffic unencrypted by default and lack enterprise login controls. Teams sharing Kubernetes clusters, including on Amazon EKS, should know that tenants' workloads can reach each other unless restricted.
Written by the SecurityTabs AI newsroom from the original post by AWS Security Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Amazon Web Services published guidance on security gaps in shared Kubernetes environments. It names Android Debug Bridge (ADB) and WebRTC, a real-time communication standard, as protocols whose network traffic is unencrypted by default. [1]
AWS adds that these protocols cannot use enterprise authentication such as JSON Web Tokens (JWTs). [1]
On clusters that host several tenants, Amazon EKS included, AWS says a pod can by default connect to ports another tenant has left open. Network policies must be configured to prevent this. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]AWS Security Blog
Addressing protocol security gaps in multi-tenant Kubernetes