Authorizing the EKS to CSC account

Create a custom IAM policy and bind it to the IAM user used by the CSC to ensure that CSC can read EKS data.

Step1: Navigate to the IAM console and click "Create policy".

Step2: Search for EKS service.

Step3: Set the "Effect" to "Allow", check "All list actions" and "All read actions", and set "Resources" to "All".

Step4: Click Next.

Step5: The policy name is named "CscEKSReadOnlyAccess", after the name is set, click "Create policy".

Step6: Follow the steps in Section 2.1 and assign this custom policy to the IAM user.

Authorizing the cluster to CSC account

Enter the cluster details page, navigate to the "Access" tab, and check which of the following authentication modes the current container cluster is using:

ConfigMap
EKS-API
EKS-API & ConfigMap

After confirming the authentication modes, please follow the corresponding sections below to proceed with the operation.

ConfigMap

Manually edit aws-auth ConfigMap using the kubectl command：

kubectl edit -n kube-system configmap/aws-auth

Add an command in the "mapUsers" section:

apiVersion: v1

data:

mapUsers: |

- userarn: <iam_user_arn>

username: <csc_user_name>

The parameter settings are as follows:

<iam_user_arn> Use the ARN of the IAM user used by the CSC in Section 2.1;
<csc_user_name> This is a custom name. It is recommended to be consistent with the ARN.

Create and bind ClusterRole

Based on the following information, create a "csc-reader" ClusterRole with minimized permissions within K8s, and bind it to <csc_user_name>

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

rules:

- apiGroups: ["rbac.authorization.k8s.io"]

resources:

- roles

- rolebindings

- clusterroles

- clusterrolebindings

verbs:

- list

- apiGroups: [""]

resources:

- pods

- namespaces

- configmaps

- services

- nodes

- persistentvolumeclaims

- persistentvolumes

- serviceaccounts

verbs:

- list

- apiGroups: ["apps"]

resources:

- deployments

- replicasets

verbs:

- list

- apiGroups: ["networking.k8s.io"]

resources:

- ingresses

- networkpolicies

verbs:

- list
---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

subjects:

- apiGroup: rbac.authorization.k8s.io

kind: User

EKS-API or EKS-API&ConfigMap

If the current identity authentication mode of the cluster is EKS API or EKS API and ConfigMap, then the following stepscan be followed:

Step1: Navigate to the cluster details page, then enter the Access tab, and create an access policy.

Step2: Select the IAM users used by CSC, with the type set as "Standard", and then click "Next"

Step3: Manually create an access policy named "AmazonEKSAdminViewPolicy". Select "Cluster" as the “access scope”, click "Add policy", and click "Next"

Step4: Click "Create" to complete the creation process.

Step5: After completing the creation, return to the "Access" tab and review the newly created access policy.

{{ $t('index.defaultHeader.logo') }}

Athena XDR (Extended Detection and Response)

Connection to Elastic Kubernetes Service