EKS

Describe how to implement security best practices for multi-tenant EKS clusters, including workload isolation, network segmentation, and identity and access management (IAM).

Multi-tenant EKS clusters require additional security considerations to isolate workloads and protect against unauthorized access. You can use Kubernetes Network Policy Enforcement (NPE) to isolate traffic between pods in different namespaces or tenants. Additionally, you can implement IAM roles and policies to restrict access to AWS resources based on the tenant or workload.

What do mean by multi tenent is eks ?

Multi-Tenancy = Running multiple teams, apps, or customers (tenants) on a single EKS cluster, but keeping them isolated and secure.
Instead of creating a separate EKS cluster for each team or app, you use one cluster and manage logical separation inside it.

How to do multiple isolated users/apps ?

✅ 1. Use Kubernetes Namespaces

Each user/app gets its own namespace.

• Example:
  • namespace: team-a
  • namespace: team-b

They cannot see each other’s pods/services by default.

✅ 2. Apply Resource Quotas & Limits: Prevent one tenant from using all cluster resources.
✅ 3. Implement RBAC (Role-Based Access Control): Control who can access what in each namespace.
✅ 4. Network Policies for Traffic Isolation: Block cross-namespace communication.
✅ 5. IAM Roles for Service Accounts (IRSA): Assign different AWS IAM roles per namespace securely.

✅ 6. Optional: Use Taints & Tolerations: Assign specific node groups for certain teams.