EKS cluster Secrets should have envelope encryption

What it checks

EKS cluster: the legacy Kubernetes version has no explicit Secrets envelope-encryption configuration.

Where it applies

Terraform: aws_eks_cluster

CloudFormation: AWS::EKS::Cluster

How to fix it

1. Verify the deployed Kubernetes version and encryption configuration. For a confirmed cluster running 1.27 or earlier without Secrets encryption, plan the documented legacy KMS association and re-encryption of existing Secrets; enabling it is irreversible. Terraform encryption_config uses resources = ["secrets"] and provider.key_arn. Review the provider plan and key access before applying. On 1.28 or later the AWS-owned default satisfies this check; customer key ownership is optional.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules