aws / aws/containers-roadmap

[EKS] [request]: EKS creates a default Security Group with outbound rules allowing all traffic

Open
#1,355 6 comments 87 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

When a new EKS cluster is created a default Security Group is created with it. This violates our company's internal security policies, and we are wondering if there is a way to simply attach an existing security group to newly created EKS resources instead.

Please note we are trying to create and manage all resources via Terraform.

The issue we are facing is described in more detail in the link below:
https://github.com/hashicorp/terraform-provider-aws/issues/18856

I have tried using console and eksctl and the result is always the same. That default is always created.

The only thing that can be done is to edit the rules once the cluster is created. This is undesirable as it becomes impossible to automate.

What we want is to be able to create the security group when we create the cluster and use ours.

Only the addition of an **additional** SG is supported but it **is not what we want**.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
The problem without this flexibility is that we cannot automate the creation of the cluster through terraform and with our security policies.

If the creation of the cluster requires manual steps after creating it, it is absolutely unmanageable for a large organization.

**Are you currently working around this issue?**
Manually removing the rule that allows all outgoing traffic and adding the rules with our security policies.

**Additional context**
I have opened a AWS support case and was suggested to open a GitHub issue for this feature request.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked Terraform provider issue and the reported behavior from EKS, the console, and eksctl. There are no repository files or tests named in this request; done would mean a documented and automatable way to create the cluster using the requested security group rather than only adding an additional group or editing rules manually.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, terraform
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.