> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/aws-in-vpc/security-best-practices.md).

# Security best practices

Security best practices for hardening an e6data In Your VPC deployment on AWS - identity, network, and EKS configuration.

e6data follows secure-by-design and privacy-by-design approaches to its systems. This means that all architectural decisions are based on minimizing access to users’ data.

While most security settings provide least privilege by default, some settings and configurations should be hardened by users prior to going to production.

1. Manage identity and access using the principles of least privilege
   1. Authenticate via single sign-on (SSO) & enable MFA within the SSO provider.
      * If not using SSO & MFA, set complex local passwords.
   2. Separate admin accounts from normal user accounts.
   3. Limit cluster creation rights/permissions.
   4. Store and use [Personal Access Tokens (PAT)](/query-engine/guides/security/access-tokens.md) securely.
   5. Cross-account IAM role configuration.
2. Protect data in-transit
   * Use AWS Private Link
3. Secure your EKS cluster & network
   1. Enable [Audit and Authenticator logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
   2. Use enable [external ingress](broken://pages/Wh4d9jql2OPH1ux7JE4O) to Clusters only for required users/IPs
   3. Use [EKS Authorized Networks](https://repost.aws/knowledge-center/eks-lock-api-access-IP-addresses) to provide EKS management API access only to e6data IPs.
   4. Implement network exfiltration protections.
      * Enable[ S3 access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html)
   5. Apply EKS service controls.
   6. Use VPC endpoint policies.
   7. Configure PrivateLink
4. Use EKS best practices when deploying workspaces
   * Add tags for cost monitoring


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/aws-in-vpc/security-best-practices.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.