eks-secrets-encrypted - AWS Config


Checks if Amazon Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys.

  • This rule is COMPLIANT if an EKS cluster has an encryptionConfig with secrets as one of the resources.

  • This rule is also COMPLIANT if the key used to encrypt EKS secrets matches with the parameter.

  • This rule is NON_COMPLIANT if an EKS cluster does not have an encryptionConfig or if the encryptionConfig resources do not include secrets.

  • This rule is also NON_COMPLIANT if the key used to encrypt EKS secrets does not match with the parameter.


Resource Types: AWS::EKS::Cluster

Trigger type: Periodic

AWS Region: All supported AWS regions


kmsKeyArns (Optional)
Type: CSV

Comma separated list of Amazon Resource Name (ARN) of the KMS key that should be used for encrypted secrets in an EKS cluster.

AWS CloudFormation template

To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.