Ensure Kubernetes Secrets Are Encrypted Using Customer Master Keys Managed AWS KMS

#!/usr/bin/env bash
#
# Report EKS secrets encryption status for one or more clusters.
#
# REQUIREMENTS (run on: any machine with AWS CLI and kubectl access):
#   - aws CLI v2 configured with permissions to describe EKS clusters
#   - jq installed
#
# USAGE:
#   ./check-eks-secrets-encryption.sh REGION CLUSTER1 [CLUSTER2 ...]
#
# NOTES:
#   - This does NOT change anything; it only reports current state.
#   - For a given cluster, **problems** are:
#       * "encryptionConfig: []"   → no EKS‑managed secrets encryption
#       * "resources: []" or missing "secrets" in resources
#       * "keyArn: null"           → no CMK configured
#       * KMS key not enabled / cannot be described

set -euo pipefail

if [ "$#" -lt 2 ]; then
  echo "Usage: $0 REGION CLUSTER1 [CLUSTER2 ...]" >&2
  exit 1
fi

REGION="$1"
shift

if ! command -v aws >/dev/null 2>&1; then
  echo "ERROR: aws CLI not found in PATH" >&2
  exit 2
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 2
fi

echo "Region: ${REGION}"
echo

for CLUSTER in "$@"; do
  echo "==== Cluster: ${CLUSTER} ===="

  # 1. Describe the cluster's encryption config from the EKS control plane
  if ! DESC_JSON=$(aws eks describe-cluster \
      --name "${CLUSTER}" \
      --region "${REGION}" 2>/dev/null); then
    echo "  ERROR: unable to describe cluster via AWS API (check name/permissions)." 
    echo
    continue
  fi

  # Extract encryption config
  ENC_JSON=$(echo "${DESC_JSON}" | jq -c '.cluster.encryptionConfig // []')

  # Human‑readable summary
  echo "  EKS encryptionConfig (control plane view):"
  echo "${ENC_JSON}" | jq '.'

  # Simple evaluations
  ENC_COUNT=$(echo "${ENC_JSON}" | jq 'length')
  if [ "${ENC_COUNT}" -eq 0 ]; then
    echo "  ISSUE: No EKS secrets encryption configured (encryptionConfig is empty)."
  else
    # For each provider entry, check secrets + keyArn
    echo "${ENC_JSON}" | jq -c '.[]' | nl -ba | while read -r IDX LINE; do
      RESOURCES=$(echo "${LINE}" | jq -r '.resources // [] | join(",")')
      KEY_ARN=$(echo "${LINE}" | jq -r '.provider.keyArn // empty')

      echo "  Provider #${IDX}:"
      echo "    resources: ${RESOURCES:-<none>}"
      echo "    keyArn:   ${KEY_ARN:-<none>}"

      if [ -z "${RESOURCES}" ]; then
        echo "    ISSUE: resources list empty; 'secrets' not covered."
      elif ! echo "${RESOURCES}" | tr ',' '\n' | grep -qx 'secrets'; then
        echo "    ISSUE: 'secrets' not present in resources; secrets not encrypted by this provider."
      fi

      if [ -z "${KEY_ARN}" ]; then
        echo "    ISSUE: keyArn is missing; CMK not configured correctly."
      else
        # 2. Describe the CMK status from KMS
        if KEY_DESC=$(aws kms describe-key \
              --key-id "${KEY_ARN}" \
              --region "${REGION}" 2>/dev/null); then
          KEY_STATE=$(echo "${KEY_DESC}" | jq -r '.KeyMetadata.KeyState')
          KEY_MANAGER=$(echo "${KEY_DESC}" | jq -r '.KeyMetadata.KeyManager')
          echo "    KMS key state:    ${KEY_STATE}"
          echo "    KMS key manager:  ${KEY_MANAGER}"
          if [ "${KEY_STATE}" != "Enabled" ]; then
            echo "    ISSUE: KMS key is not Enabled (current state: ${KEY_STATE})."
          fi
          if [ "${KEY_MANAGER}" != "CUSTOMER" ]; then
            echo "    ISSUE: KMS key is not a customer managed CMK (KeyManager=${KEY_MANAGER})."
          fi
        else
          echo "    ISSUE: unable to describe KMS key (check IAM or key exists)."
        fi
      fi
    done
  fi

  echo
done

./check-eks-secrets-encryption.sh us-east-1 my-prod-cluster my-dev-cluster