A Shared-Responsibility CIS Kubernetes Assessment

A software company needed a control-by-control view of its managed Kubernetes environments on Amazon EKS and Linode LKE. We mapped provider and customer responsibilities, reviewed the customer-managed surfaces, and organized technical evidence without representing the work as certification.

Assessment diagram showing CIS Kubernetes Benchmark controls divided between managed provider responsibilities and customer-managed workloads, RBAC, network policies, and nodes across Amazon EKS and Linode LKE, with kube-bench evidence feeding documented findings.

AWS Advanced Tier Partner★ 4.9/5 on Clutch (9 reviews)Replies within 1 business day

The Challenge

The company operated Kubernetes workloads across Amazon EKS and Linode LKE and needed to assess them against the CIS Kubernetes Benchmark. A simple checklist could not distinguish managed control plane settings from configuration the customer could inspect or change.

The assessment needed defensible responsibility statements, evidence for observable controls, and clear findings for workloads, access, networking, and nodes. Its purpose was to document posture and remediation needs, not to claim certification or compliance.

How We Assessed the Environment

Shared-Responsibility Mapping

We mapped managed control plane controls to the relevant provider responsibility and documented why some settings could not be configured directly by the customer.

Workload Configuration Review

We reviewed customer-managed workload configuration against the benchmark areas that could be evaluated from deployed Kubernetes resources.

RBAC and Access Review

We examined role-based access configuration and related access paths to identify where permissions and administrative boundaries required attention.

Network and Node Review

Network policy and node configuration were assessed separately from managed control plane responsibilities so the findings remained actionable for the operating team.

kube-bench Evidence

Where the environment exposed a testable surface, kube-bench output supported the technical evidence. Automated observations were paired with manual context rather than treated as a complete assessment on their own.

Documented Findings

Each control received a responsibility position, available evidence, and an assessment note so stakeholders could understand what was managed by the provider and what required customer action.

What the Assessment Delivered

The organization received a control-by-control assessment spanning both managed Kubernetes providers.
Managed control plane responsibilities were separated from customer-managed workload, access, network, and node responsibilities.
kube-bench results and manual review notes were organized as evidence for follow-up and remediation planning, without making a certification or pass claim.

Technology

CIS Kubernetes BenchmarkAmazon EKSLinode LKEKubernetes RBACNetworkPolicykube-bench

Planning a similar platform?

Share the constraint behind your cloud, delivery, Kubernetes, or compliance project. We will confirm fit and identify three useful priorities for the first conversation.

Book an AWS review

Explore More Services

AWS Cloud Infrastructure Cloud Architecture Advisory DevOps and CI/CD Kubernetes and Amazon EKS Security and Compliance AWS Cloud Migration Book an AWS review