// the find
aws-samples/hardeneks
Runs checks to see if an EKS cluster follows EKS Best Practices.
A CLI that audits an EKS cluster against AWS's own EKS Best Practices guide, covering IAM, pod security, network policy, encryption, autoscaling, and control-plane config. Built by AWS itself (aws-samples), so it's a reasonable one-shot compliance sweep for anyone running EKS who wants a checklist beyond 'kubectl get pods and hope'.
Checks map directly to the published best-practices doc section by section, so results are explainable and you can go read the rationale instead of trusting a black box. The config file lets you enable/disable individual rules and skip namespaces, which matters because out of the box it'll flag kube-system and vendor add-ons you don't control. Test coverage is unusually thorough for a tool like this — nearly every check has paired good.yaml/bad.yaml fixtures plus mocked API responses, so regressions in rule logic would actually get caught. Export options (txt/csv/html/json, plus a direct Security Hub push) mean it slots into existing reporting pipelines instead of forcing you to parse stdout.
It's a point-in-time scanner with no enforcement hook — nothing stops a bad manifest from shipping, and there's no CI gate or exit-code severity threshold documented, so it's advisory only unless you wire that up yourself. The sample minimal IAM policy uses Resource: "*" on everything, which is a sloppy example for a tool whose whole purpose is catching lax IAM — tighten that before copy-pasting it into a real account. No drift tracking between runs; each invocation is stateless, so trending 'are we getting better or worse' requires your own storage and diffing of the JSON export. Namespace-based checks run per-namespace with no obvious concurrency, so on a cluster with hundreds of namespaces this could get slow — there's no benchmark or timing data in the README to tell you.