AWS EKS

This plugin collects read-only Amazon EKS data, evaluates CCF Rego policy bundles, and emits evidence back through the CCF agent.

This page is for operators who run the plugin-aws-eks plugin with the CCF Agent, and for developers who write policies for it. It documents v0.1.2 and is generated from the plugin's README at v0.1.2.

How it works

How It Fits In CCF

The CCF agent starts this binary through HashiCorp go-plugin, passes configuration and policy paths over gRPC, and receives generated evidence through the runner callback. This repository does not call the CCF API directly.

Requirements

IAM Permissions

The AWS principal used by the plugin needs read-only EKS permissions for the configured regions:

{
  "Effect": "Allow",
  "Action": [
    "eks:ListClusters",
    "eks:DescribeCluster",
    "eks:ListNodegroups",
    "eks:DescribeNodegroup",
    "eks:ListAddons",
    "eks:DescribeAddon"
  ],
  "Resource": "*"
}

Configuration

The plugin expects:

AWS credentials through the default AWS SDK credential chain
target regions from config.regions or config.region
AWS_REGION as a fallback when plugin config does not provide a region

Any agent-supplied policy_data is passed through to Rego as data.*.

Example agent plugin config:

plugins:
  aws-eks:
    protocol_version: 2
    source: /path/to/dist/plugin
    config:
      regions: "eu-west-2,us-east-1"
    policies:
      - /path/to/plugin-aws-eks-policies/dist/bundle.tar.gz
      - /path/to/plugin-aws-eks-nodegroup-policies/dist/bundle.tar.gz
      - /path/to/plugin-aws-eks-addon-policies/dist/bundle.tar.gz

Evidence collected

Supported Resource Families

The collector evaluates policies for:

EKS clusters
EKS managed node groups
EKS managed add-ons

Data Collected

Depending on the selected policy bundles, the plugin collects and reuses:

ListClusters and DescribeCluster
ListNodegroups and DescribeNodegroup
ListAddons and DescribeAddon

The plugin collects shared regional datasets once and reuses them across resource-family evaluation to reduce AWS API calls.

Policies

The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.

Bundle	Latest version	Controls covered	Compatible plugin lines
`plugin-aws-eks-addon-policies`	`v0.1.0`	A1.2, CC7.2	latest
`plugin-aws-eks-nodegroup-policies`	`v0.1.0`	A1.2, CC6.6, CC6.7, CC7.2	latest
`plugin-aws-eks-policies`	`v0.1.0`	A1.2, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC7.2, CC7.3	latest

Default Policy Bundle Mapping

Repository	Behavior	Primary input
`plugin-aws-eks-policies`	`cluster`	`input.cluster` + `input.cluster_context`
`plugin-aws-eks-nodegroup-policies`	`nodegroup`	`input.nodegroup` + `input.nodegroup_context`
`plugin-aws-eks-addon-policies`	`addon`	`input.addon` + `input.addon_context`

Each bundle evaluates one resource family at a time. Cluster context includes summarized related managed node groups and add-ons so cluster-level policies can check required add-ons without evaluating add-on policies against cluster input.

How it works​

How It Fits In CCF​

Requirements​

IAM Permissions​

Configuration​

Evidence collected​

Supported Resource Families​

Data Collected​

Policies​

Default Policy Bundle Mapping​