Deploying the security agent to Amazon EKS - Amazon GuardDuty
Automated agent configuration (recommended)Manual agent configurationRelated topics
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Deploying the security agent to Amazon EKS

GuardDuty Runtime Monitoring monitors your Amazon EKS clusters for threats by deploying the GuardDuty security agent to them. On Amazon EKS, GuardDuty deploys the agent as the EKS add-on aws-guardduty-agent.

Notes

Runtime Monitoring supports Amazon EKS clusters running on Amazon EC2 instances and Amazon EKS Auto Mode.

Runtime Monitoring doesn't support Amazon EKS clusters with Amazon EKS Hybrid Nodes, and those running on AWS Fargate.

For information about these Amazon EKS features, see What is Amazon EKS? in the Amazon EKS User Guide.

You can let GuardDuty manage the agent automatically (recommended) or manage it manually.

Automated agent configuration (recommended)

GuardDuty manages deployment and updates to the security agent for your EKS clusters. In the GuardDuty console, this configuration appears as Runtime Monitoring (EKS).

For how the security agent connects to GuardDuty, see How the security agent connects to GuardDuty.

Impact of enabling the security agent

GuardDuty deploys the security agent to your EKS clusters, and Amazon Elastic Kubernetes Service (Amazon EKS) coordinates deploying it to the nodes.

Monitoring scope

By default, GuardDuty manages the security agent for all EKS clusters in your account, including new clusters you create. To stop GuardDuty from managing the agent on a specific cluster, add the tag GuardDutyManaged:false to that cluster.

For more information about tagging EKS clusters, see Tagging your Amazon EKS resources in the Amazon EKS User Guide.

Considerations

  • When automated agent configuration is off, GuardDuty manages the security agent only on the EKS clusters that you tag with GuardDutyManaged:true.

  • Adding the GuardDutyManaged:false tag stops GuardDuty from managing the security agent, but doesn't uninstall an agent that is already installed.

  • Protect the GuardDutyManaged tag by controlling who can modify it, using service control policies or IAM policies. For more information, see Service control policies (SCPs) in the AWS Organizations User Guide or Control access to AWS resources in the IAM User Guide.

Manual agent configuration

Use this approach when you want to manually deploy and manage the GuardDuty security agent on all your EKS clusters. Ensure Runtime Monitoring is enabled for your accounts. The GuardDuty security agent might not work as expected if Runtime Monitoring isn't enabled.

Impact of using this approach

You must coordinate deploying the GuardDuty security agent within your EKS clusters across all your accounts. To get the latest security features, you must also update the agent when GuardDuty releases a new version. For more information about agent versions for EKS, see GuardDuty security agent versions for Amazon EKS resources.

Considerations

You must support secure data flow while monitoring for and addressing coverage gaps as new clusters and workloads are continuously deployed.