Skip to main content
e6data follows secure-by-design and privacy-by-design approaches to its systems. This means that all architectural decisions are based on minimizing access to users’ data. While most security settings provide least privilege by default, some settings and configurations should be hardened by users prior to going to production.
  1. Manage identity and access using the principles of least privilege
    1. Authenticate via single sign-on (SSO) & enable MFA within the SSO provider.
      • If not using SSO & MFA, set complex local passwords.
    2. Separate admin accounts from normal user accounts.
    3. Limit cluster creation rights/permissions.
    4. Store and use Personal Access Tokens (PAT) securely.
    5. Cross-account IAM role configuration.
  2. Protect data in-transit
    • Use AWS Private Link
  3. Secure your EKS cluster & network
    1. Enable Audit and Authenticator logging
    2. Enable external ingress to clusters only for required users/IPs.
    3. Use EKS Authorized Networks to provide EKS management API access only to e6data IPs.
    4. Implement network exfiltration protections.
    5. Apply EKS service controls.
    6. Use VPC endpoint policies.
    7. Configure PrivateLink
  4. Use EKS best practices when deploying workspaces
    • Add tags for cost monitoring
Last modified on October 1, 2026