Security best practices

Security best practices for hardening an e6data In Your VPC deployment on AWS - identity, network, and EKS configuration.

e6data follows secure-by-design and privacy-by-design approaches to its systems. This means that all architectural decisions are based on minimizing access to users’ data.

While most security settings provide least privilege by default, some settings and configurations should be hardened by users prior to going to production.

1. Manage identity and access using the principles of least privilege

   1. Authenticate via single sign-on (SSO) & enable MFA within the SSO provider.

      • If not using SSO & MFA, set complex local passwords.
   2. Separate admin accounts from normal user accounts.
   3. Limit cluster creation rights/permissions.
   4. Store and use Personal Access Tokens (PAT) securely.
   5. Cross-account IAM role configuration.
2. Protect data in-transit

   • Use AWS Private Link
3. Secure your EKS cluster & network

   1. Enable Audit and Authenticator logging
   2. Use enable external ingress to Clusters only for required users/IPs
   3. Use EKS Authorized Networks to provide EKS management API access only to e6data IPs.
   4. Implement network exfiltration protections.

      • Enable S3 access logging
   5. Apply EKS service controls.
   6. Use VPC endpoint policies.
   7. Configure PrivateLink
4. Use EKS best practices when deploying workspaces

   • Add tags for cost monitoring