🔐 Securing AWS EKS with Kyverno, Calico & GuardDuty

📌 Introduction

As Kubernetes adoption grows, so do security challenges. AWS Elastic Kubernetes Service (EKS) provides a scalable platform, but misconfigurations can lead to data breaches, IAM misuse, and compromised workloads.

In this project, we will enforce security policies using Kyverno, restrict network communication using Calico, and detect security threats using AWS GuardDuty.

💡 Did You Know? 🔹 58% of Kubernetes clusters are exposed to security threats due to misconfigurations. 🔹 A cryptojacking attack in Kubernetes can cost over $50,000 per month in stolen cloud resources. 🔹 AWS GuardDuty for EKS was launched to detect API abuse, privilege escalation, and network threats automatically.

📖 Concepts: Understanding Key Security Tools

Let’s explore the three core security components in this project:

1️⃣ Kyverno — Kubernetes Policy Engine

Kyverno enforces security policies at the Kubernetes level to prevent misconfigurations.

✅ What It Does?

• Prevents running containers as root user.
• Denies privileged containers.
• Enforces resource limits to prevent resource exhaustion.

2️⃣ Calico — Network Policy Enforcement

Calico provides fine-grained network control, allowing you to restrict pod-to-pod communication inside EKS.

✅ What It Does?

• Blocks unwanted network access between pods.
• Prevents lateral movement of attackers inside the cluster.
• Ensures only authorized services communicate with each other.

3️⃣ AWS GuardDuty — Threat Detection for EKS

GuardDuty detects real-time security threats by monitoring AWS API calls, network traffic, and Kubernetes activity.

✅ What It Does?

• Detects unauthorized IAM role assumptions.
• Flags suspicious API calls (e.g., kubectl exec abuse).
• Identifies cryptojacking & botnet activity in pods.

🛠 Step-by-Step Implementation Guide

Follow these steps to fully secure an AWS EKS cluster.

Clone my GitHub Repository to implement the project https://github.com/somameenakayathirim/EKS_Secure_using_Calico_Kyverno_GuardDuty_project

1.Set Up an EKS Cluster

eksctl create cluster --name eks-security-cluster --region us-east-2 --nodegroup-name secured-nodes --node-type t3.medium --nodes 2 --nodes-min 1 --nodes-max 3  --managed

2. Install Kyverno for Policy Enforcement

kubectl apply -f https://github.com/kyverno/kyverno/releases/latest/download/install.yaml

3. Pod Restrictions in Kyverno

Kyverno can enforce Pod Security Standards (PSS) and custom governance rules by restricting how pods are created and configured. These restrictions help secure workloads in AWS EKS by preventing insecure configurations.

Here are some important restrictions:

3.1. Deny Running as Root User: Why? Running containers as the root user can increase security risks if the container is compromised.

3.2. Deny Privileged Containers: Why? Privileged containers have full access to the host system, which can lead to security breaches.

3.3. Enforce Resource Limits (CPU & Memory):Why? Restricting resource usage prevents resource exhaustion and ensures fair usage across workloads.

Example : kyverno_pod_restriction.yml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-pod-standard-security
spec:
  validationFailureAction: enforce
  rules:
    - name: pod-security
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: "Privileged containers/RunAsRootUser are not allowed in this cluster"
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: false
                  allowPrivilegeEscalation: false
                  runAsNonRoot: true

4. Install Calico for Network Restrictions

Tigera Operator is responsible to install Calico CNI in an AWS EKS cluster

kubectl apply --server-side -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/tigera-operator.yaml

Install Calico CNI in Chaining node( install-cni.yml)

apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
  namespace: tigera-operator
spec:
  kubernetesProvider: EKS
  cni:
    type: AmazonVPC
  calicoNetwork:
    bgp: Disabled

Execute kubectl apply -f install-cni.yml

Enforce Pod Communication Restrictions

Deploy a sample application Frontend, Payment, Database. In this scenario, we need to restrict the Database pod communication only from Payment pod. To achieve this, create a network policy as below, (calico-network-policy.yml)

apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
  name: allow-only-payment-to-database
  namespace: default
spec:
  selector: app == "database"
  order: 100
  ingress:
    - action: Allow
      source:
        selector: app == "payment"
  types:
    - Ingress
    - Egress

Apply the network policy kubectl apply -f calico-network-policy.yml

Test the pod network restriction

1. Login to Payment pod and test the communication using ping <database-pod-ip> and it should work as shown in below screenshot.

2. Login to Frontend pod and give ping <database-pod-ip> and it should not communicate with database pod as shown in below screenshot.

5. Enable AWS GuardDuty

Enable Guard Duty and you will get <Detector_ID> as output for below command

aws guardduty create-detector --enable

Update the detector for AWS EKS

aws guardduty update-detector --detector-id <DETECTOR_ID> --enable

6. Test GuardDuty Detection

Scenario: Suspicious CryptoCurrency

Create a yml file as cryptominer-test.yml

apiVersion: v1
kind: Pod
metadata:
  name: cryptominer-test
spec:
  containers:
    - name: cryptominer
      image: alpine
      command: ["/bin/sh", "-c", "sleep 3600"]

Deploy the pod using kubectl apply -f cryptominer-test.yml

Login to the pod as below

kubectl exec -it cryptominer-test -- /bin/sh

Inside the pod hit the cryptomining url

wget http://pool.minexmr.com

By Default, AWS will block above cryptomining URLs. Still, GuardDuty will detect the attempt to query the URL.

Go to GuardDuty console in AWS, you will see the GuardDutyFinding as shown below,

7. Implement Additional Security Measures

7.1 Create an AWS KMS key

aws kms create-key --description "EKS Secrets Encryption Key"

7.2 In the AWS Console, navigate to the EKS Configuration Page, enable encryption, and select the KMS key created from previous step from the dropdown.

7.3 Store database password securely using Kubernetes Secrets:

kubectl create secret generic db-password --from-literal=password='SuperSecretP@ssword'

7.4 Verify secret storage:

kubectl get secret db-password -o yaml

🔍 Summary & Key Takeaways

✅ Kyverno prevents misconfigurations (blocks root & privileged pods). ✅ Calico enforces network segmentation (prevents lateral movement). ✅ GuardDuty detects runtime threats (API abuse, cryptojacking). ✅ KMS encryption & runtime security complete EKS hardening.

Happy Cloud Computing!!!