EKS node group with SSH access should restrict source security groups
What it checks
EKS node group with SSH access should restrict source security groups
Where it applies
Terraform: aws_eks_node_group
CloudFormation: AWS::EKS::Nodegroup
How to fix it
- Add source_security_group_ids to the remote_access block, listing only the security groups (e.g. a bastion SG) allowed remote access to the nodes. Without it, EKS opens port 22 (3389 on Windows node groups) to 0.0.0.0/0.
Frameworks
- NIST 800-53 rev5 SC-7
- SOC 2 CC6.6
These mappings are advisory, not an attestation of compliance.