EKS Security Group Configuration

EKS Security Group Configuration An architecture diagram generated by Archify. Load Balancer · 80 / 443 inbound · Architecture component Load Balancer 80 / 443 inbound EKS API Server · Control plane security group · Architecture component EKS API Server Control plane security group Other Worker Nodes · Worker node security group · Architecture component Other Worker Nodes Worker node security group Worker Nodes · Worker node security group · Architecture component Worker Nodes Worker node security group Internet · ECR · S3 · Images · packages · Architecture component Internet · ECR · S3 Images · packages Forwards to NodePort 443/TCP 1025-65535/TCP kubelet ALL node-to-node ALL → 0.0.0.0/0 Legend Backend Cloud External

Control plane security group

  • • Inbound 443/TCP — allowed only from the worker node security group
  • • Outbound 1025-65535/TCP — sent only to the worker node security group
  • • kubectl exec, logs, and port-forward all use this outbound range

Worker node security group

  • • Inbound 443/TCP and 1025-65535/TCP — allowed from the control plane security group
  • • Inbound ALL — from the same worker node security group (node-to-node pod traffic)
  • • Outbound ALL to 0.0.0.0/0 — image pulls and AWS API calls

Best practices

  • • Avoid inbound 0.0.0.0/0; reference a security group ID as the source instead
  • • Keep port ranges as narrow as possible and prune unused rules regularly
  • • Separate load balancer, database, and administrative security groups by role