A team runs workloads on Amazon EKS and must protect Kubernetes Secrets stored in etcd. Which feature should they turn on?
Show answer and explanation
Answer: B
EKS can wrap the data key used for Secrets with a KMS key, so the secret material written to etcd is ciphertext whose key is held in KMS. A copy of the etcd volume then cannot be read without permission to call KMS for decryption.
The KMS key policy and CloudTrail logs also give you an audit trail of every decrypt attempt.
Why the other options are wrong
- A. Encrypting node volumes protects the disk beneath the pod but leaves the secret objects decrypted inside etcd.
- C. IRSA gives pods AWS permissions through a service account; it does not change how the API server stores Secrets.
- D. Flow Logs capture network metadata and have no effect on data at rest.