> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Misconfig for AWS

### Checks Performed

* [An Admission Policy Engine Should Enforce Workload Policy](awskubernetesmisconfig/rules/aws_admission_policy_engine_enforced)
* [Audit Logging Should Be Enabled And Shipped Off-Cluster](awskubernetesmisconfig/rules/aws_audit_logging_shipped_offcluster)
* [Consider External Secret Storage](awskubernetesmisconfig/rules/aws_consider_external_secret_storage)
* [Container Images Should Not Use The latest Or Untagged Tag](awskubernetesmisconfig/rules/aws_no_latest_image_tag)
* [Containers Should Define Liveness And Readiness Probes](awskubernetesmisconfig/rules/aws_define_liveness_readiness_probes)
* [Containers Should Disallow Privilege Escalation](awskubernetesmisconfig/rules/aws_disallow_privilege_escalation)
* [Containers Should Drop All Linux Capabilities](awskubernetesmisconfig/rules/aws_drop_all_capabilities)
* [Containers Should Not Run In Privileged Mode](awskubernetesmisconfig/rules/aws_no_privileged_container)
* [Containers Should Run As Non-Root](awskubernetesmisconfig/rules/aws_container_run_as_nonroot)
* [Containers Should Set CPU And Memory Limits](awskubernetesmisconfig/rules/aws_set_resource_limits)
* [Containers Should Set CPU And Memory Requests](awskubernetesmisconfig/rules/aws_set_resource_requests)
* [Containers Should Use A Read-Only Root Filesystem](awskubernetesmisconfig/rules/aws_readonly_root_filesystem)
* [Create Administrative Boundaries Between Resources Using Namespaces](awskubernetesmisconfig/rules/aws_administrative_boundaries_via_namespaces)
* [Enable Audit Logs](awskubernetesmisconfig/rules/aws_enable_audit_logs)
* [Encrypt Traffic To HTTPS Load Balancers With TLS Certificates](awskubernetesmisconfig/rules/aws_encrypt_traffic_to_https_load_balancers_tls)
* [Ensure Audit Logs Are Collected And Managed](awskubernetesmisconfig/rules/aws_ensure_audit_logs_collected_and_managed)
* [Ensure Clusters Are Created With Private Endpoint Enabled And Public Access Disabled](awskubernetesmisconfig/rules/aws_cluster_private_endpoint_public_access_disabled)
* [Ensure Clusters Are Created With Private Nodes](awskubernetesmisconfig/rules/aws_cluster_created_with_private_nodes)
* [Ensure CNI Plugin Supports Network Policies](awskubernetesmisconfig/rules/aws_cni_plugin_supports_network_policies)
* [Ensure Image Vulnerability Scanning Using Amazon ECR Or Third Party Provider](awskubernetesmisconfig/rules/aws_ecr_image_vulnerability_scanning_enabled)
* [Ensure Kubelet Configuration File Ownership Is Set To root:root](awskubernetesmisconfig/rules/aws_kubelet_config_file_ownership_root)
* [Ensure Kubelet Configuration File Permissions Are 644 Or More Restrictive](awskubernetesmisconfig/rules/aws_kubelet_config_file_permissions_644)
* [Ensure Kubelet Kubeconfig File Ownership Is Set To root:root](awskubernetesmisconfig/rules/aws_kubelet_kubeconfig_file_ownership_root)
* [Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive](awskubernetesmisconfig/rules/aws_kubelet_kubeconfig_file_permissions_644)
* [Ensure Kubernetes Secrets Are Encrypted Using CMKs Managed In AWS KMS](awskubernetesmisconfig/rules/aws_kubernetes_secrets_encrypted_with_kms_cmk)
* [Ensure Network Policy Is Enabled And Set As Appropriate](awskubernetesmisconfig/rules/aws_network_policy_enabled_and_configured)
* [Ensure That A Client CA File Is Configured](awskubernetesmisconfig/rules/aws_kubelet_client_ca_file_configured)
* [Ensure That All Namespaces Have Network Policies Defined](awskubernetesmisconfig/rules/aws_all_namespaces_have_network_policies)
* [Ensure That Anonymous Auth Is Not Enabled](awskubernetesmisconfig/rules/aws_kubelet_anonymous_auth_disabled)
* [Ensure That Default Service Accounts Are Not Actively Used](awskubernetesmisconfig/rules/aws_default_service_accounts_not_used)
* [Ensure That Service Account Tokens Are Only Mounted Where Necessary](awskubernetesmisconfig/rules/aws_service_account_tokens_mounted_when_necessary)
* [Ensure That The --authorization-mode Argument Is Not Set To AlwaysAllow](awskubernetesmisconfig/rules/aws_kubelet_authorization_mode_not_alwaysallow)
* [Ensure That The --eventRecordQPS Argument Is Set Appropriately](awskubernetesmisconfig/rules/aws_kubelet_event_qps_appropriate)
* [Ensure That The --make-iptables-util-chains Argument Is Set To True](awskubernetesmisconfig/rules/aws_kubelet_make_iptables_util_chains_true)
* [Ensure That The --read-only-port Is Disabled](awskubernetesmisconfig/rules/aws_kubelet_read_only_port_disabled)
* [Ensure That The --rotate-certificates Argument Is Not Present Or Is Set To True](awskubernetesmisconfig/rules/aws_kubelet_rotate_certificates_true)
* [Ensure That The --streaming-connection-idle-timeout Argument Is Not Set To 0](awskubernetesmisconfig/rules/aws_kubelet_streaming_connection_idle_timeout)
* [Ensure That The RotateKubeletServerCertificate Argument Is Set To True](awskubernetesmisconfig/rules/aws_kubelet_rotate_server_certificate_true)
* [Ensure The Cluster-Admin Role Is Only Used Where Required](awskubernetesmisconfig/rules/aws_cluster_admin_role_restricted)
* [Every Non-System Namespace Should Have A Default-Deny NetworkPolicy](awskubernetesmisconfig/rules/aws_default_deny_networkpolicy)
* [Limit Use Of The Bind, Impersonate And Escalate Permissions](awskubernetesmisconfig/rules/aws_limit_bind_impersonate_escalate)
* [Manage Kubernetes RBAC Users With AWS IAM Authenticator Or Upgrade AWS CLI](awskubernetesmisconfig/rules/aws_manage_rbac_users_with_aws_iam_authenticator)
* [Minimize Access To Create PersistentVolume Objects](awskubernetesmisconfig/rules/aws_minimize_create_persistentvolume_access)
* [Minimize Access To Create Pods](awskubernetesmisconfig/rules/aws_minimize_create_pods_access)
* [Minimize Access To Secrets](awskubernetesmisconfig/rules/aws_minimize_secrets_access)
* [Minimize Access To The Proxy Sub-Resource Of Node Objects](awskubernetesmisconfig/rules/aws_minimize_node_proxy_subresource_access)
* [Minimize Access To The Service Account Token Creation](awskubernetesmisconfig/rules/aws_minimize_service_account_token_creation)
* [Minimize Access To Webhook Configuration Objects](awskubernetesmisconfig/rules/aws_minimize_webhook_configuration_access)
* [Minimize Cluster Access To Read-Only For Amazon ECR](awskubernetesmisconfig/rules/aws_minimize_cluster_access_readonly_ecr)
* [Minimize Container Registries To Only Those Approved](awskubernetesmisconfig/rules/aws_minimize_container_registries_to_approved)
* [Minimize The Admission Of Containers Sharing The Host IPC Namespace](awskubernetesmisconfig/rules/aws_minimize_hostipc_containers)
* [Minimize The Admission Of Containers Sharing The Host Network Namespace](awskubernetesmisconfig/rules/aws_minimize_hostnetwork_containers)
* [Minimize The Admission Of Containers Sharing The Host Process ID Namespace](awskubernetesmisconfig/rules/aws_minimize_hostpid_containers)
* [Minimize The Admission Of Containers With allowPrivilegeEscalation](awskubernetesmisconfig/rules/aws_minimize_allow_privilege_escalation)
* [Minimize The Admission Of Privileged Containers](awskubernetesmisconfig/rules/aws_minimize_privileged_containers)
* [Minimize User Access To Amazon ECR](awskubernetesmisconfig/rules/aws_minimize_user_access_to_ecr)
* [Minimize Wildcard Use In Roles And ClusterRoles](awskubernetesmisconfig/rules/aws_minimize_wildcard_roles)
* [Multi-Replica Deployments Should Have A PodDisruptionBudget](awskubernetesmisconfig/rules/aws_multireplica_poddisruptionbudget)
* [Mutable Image Tags Should Use imagePullPolicy Always](awskubernetesmisconfig/rules/aws_mutable_tag_pullpolicy_always)
* [Namespaces Should Enforce Pod Security Admission Baseline Or Stricter](awskubernetesmisconfig/rules/aws_enforce_pod_security_admission)
* [No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users](awskubernetesmisconfig/rules/aws_no_anonymous_rolebindings)
* [No ServiceAccount Should Be Bound To cluster-admin](awskubernetesmisconfig/rules/aws_no_serviceaccount_cluster_admin)
* [No Workloads Should Run In The default Namespace](awskubernetesmisconfig/rules/aws_no_workloads_default_namespace)
* [Pods Should Be Managed By A Controller](awskubernetesmisconfig/rules/aws_pods_managed_by_controller)
* [Pods Should Not Mount HostPath Volumes](awskubernetesmisconfig/rules/aws_no_hostpath_volumes)
* [Pods Should Not Share Host Namespaces](awskubernetesmisconfig/rules/aws_no_host_namespace_sharing)
* [Pods That Do Not Use The API Should Disable Token Automount](awskubernetesmisconfig/rules/aws_disable_token_automount)
* [pods/exec Should Not Be Granted To Broad Subjects](awskubernetesmisconfig/rules/aws_restrict_pods_exec)
* [Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens](awskubernetesmisconfig/rules/aws_prefer_projected_sa_tokens)
* [Prefer Using Dedicated Amazon EKS Service Accounts](awskubernetesmisconfig/rules/aws_prefer_dedicated_eks_service_accounts)
* [Prefer Using Secrets As Files Over Secrets As Environment Variables](awskubernetesmisconfig/rules/aws_prefer_secrets_as_files)
* [Restrict Access To The Control Plane Endpoint](awskubernetesmisconfig/rules/aws_restrict_access_control_plane_endpoint)
* [Secrets Should Be Encrypted At Rest](awskubernetesmisconfig/rules/aws_secrets_encrypted_at_rest)
* [Sensitive Values Should Not Be Passed As Literal Env Vars](awskubernetesmisconfig/rules/aws_no_literal_secret_env)
* [Tenant Namespaces Should Have A ResourceQuota](awskubernetesmisconfig/rules/aws_namespace_resourcequota)
* [The Default Namespace Should Not Be Used](awskubernetesmisconfig/rules/aws_default_namespace_not_used)
* [Use Cluster Access Manager API To Manage Access Controls](awskubernetesmisconfig/rules/aws_cluster_access_manager_api)