Security Policy

Overview

The EKS Helm Client GitHub Action is designed with security as a primary concern. This document outlines our security practices, how to report vulnerabilities, and the security features built into the action, including comprehensive security measures for private Helm package deployments.

Security Features

🔒 Container Security

🛡️ Authentication & Authorization

🔐 Data Protection

🌐 Network Security

📦 Private Registry Security

📋 Supply Chain Security

Supported Security Configurations

IAM Roles for Service Accounts (IRSA) - Recommended

- name: Configure AWS Credentials with IRSA
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/EKSHelmDeploymentRole
    role-session-name: github-actions-deployment
    aws-region: us-west-2

- name: Deploy with IRSA
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    cluster-name: production-cluster
    region: us-west-2
    auto-login-ecr: true
    verify-charts: true
    validate-manifests: true

Cross-Account Role Assumption

- name: Deploy to Cross-Account Cluster
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    cluster-name: shared-cluster
    region: us-west-2
    role-arn: arn:aws:iam::987654321098:role/CrossAccountEKSAccess
    assume-role-session-name: github-actions-cross-account

Private Cluster with Enhanced Security

- name: Deploy to Private Cluster
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    cluster-name: private-production
    region: us-west-2
    private-cluster: true
    vpc-endpoint: https://vpce-12345.eks.us-west-2.vpce.amazonaws.com
    verify-charts: true
    enable-secrets-manager: true
    auto-login-ecr: true

Required IAM Permissions

Minimum Permissions for Public Clusters

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "eks:DescribeCluster"
      ],
      "Resource": "arn:aws:eks:*:*:cluster/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Enhanced Permissions for Private Registry Support

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "eks:DescribeCluster",
        "eks:ListClusters"
      ],
      "Resource": "arn:aws:eks:*:*:cluster/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "sts:AssumeRole"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:helm/*",
      "Condition": {
        "StringEquals": {
          "secretsmanager:ResourceTag/Environment": ["production", "staging"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::your-helm-backups/*"
    }
  ]
}

Cross-Account ECR Access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "arn:aws:ecr:*:ACCOUNT-ID:repository/*"
    }
  ]
}

Security Best Practices

1. Use IRSA Instead of Long-Term Credentials

❌ Don’t use long-term AWS access keys:

# DON'T DO THIS
env:
  AWS_ACCESS_KEY_ID: $
  AWS_SECRET_ACCESS_KEY: $

✅ Use IRSA for temporary credentials:

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: $
    role-session-name: github-actions-deployment

2. Secure Private Registry Authentication

✅ Use AWS Secrets Manager for registry credentials:

- name: Deploy with Secure Registry Auth
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    enable-secrets-manager: true
    private-registry-username-secret: helm/registry/username
    private-registry-password-secret: helm/registry/password

❌ Don’t use plain text credentials:

# DON'T DO THIS
with:
  private-registry-username: myuser
  private-registry-password: mypassword

3. Enable Chart Verification for Production

- name: Deploy with Verified Charts
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    verify-charts: true
    helm-commands: |
      helm repo add bitnami https://charts.bitnami.com/bitnami
      helm repo update
      helm install my-app bitnami/nginx --verify

4. Use ECR for Private Charts in AWS

- name: Secure ECR Deployment
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    auto-login-ecr: true
    helm-commands: |
      helm upgrade --install my-app \
        oci://123456789012.dkr.ecr.us-west-2.amazonaws.com/charts/my-app \
        --version 1.0.0

5. Validate Manifests Before Deployment

- name: Deploy with Validation
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    validate-manifests: true
    atomic: true
    wait: true

6. Use Private Clusters for Production

- name: Deploy to Private Production Cluster
  uses: open-source-srilanka/eks-helm-client-github-action@v2.0.0
  with:
    cluster-name: private-prod
    private-cluster: true
    vpc-endpoint: $
    auto-login-ecr: true
    verify-charts: true

Private Registry Security Guidelines

AWS ECR Security

  1. Use IRSA: Always prefer IAM roles over access keys
  2. Least privilege: Grant minimal ECR permissions
  3. Cross-account access: Use resource-based policies for shared registries
  4. Image scanning: Enable ECR vulnerability scanning
  5. Lifecycle policies: Implement image retention policies

GitHub Container Registry Security

  1. Token scope: Use tokens with minimal required scopes
  2. Package visibility: Set appropriate package visibility (private for sensitive charts)
  3. Access control: Use GitHub teams for package access control
  4. Audit logs: Monitor package access through GitHub audit logs

Private Repository Security

  1. HTTPS only: Always use HTTPS for repository connections
  2. Strong authentication: Use strong passwords or tokens
  3. Certificate validation: Never skip TLS certificate validation
  4. Access logging: Monitor repository access logs
  5. Regular rotation: Rotate credentials regularly

Multi-Registry Security

  1. Credential isolation: Each registry uses separate credentials
  2. Secure storage: Store all credentials in AWS Secrets Manager
  3. Access auditing: Log all registry authentication attempts
  4. Failure handling: Fail securely if authentication fails

Private Cluster Security Configuration

VPC Endpoints Required

For private clusters, ensure these VPC endpoints are configured:

Security Group Rules

# Allow HTTPS traffic to VPC endpoints
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --source-group sg-87654321

# Allow ECR traffic for private registries
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

Registry-Specific Security Considerations

ECR Security Checklist

GitHub Packages Security Checklist

Private Registry Security Checklist

Vulnerability Reporting

Reporting Security Vulnerabilities

We take security vulnerabilities seriously. Please report security issues responsibly:

  1. DO NOT create public GitHub issues for security vulnerabilities
  2. Email us directly: dinushchathurya21@gmail.com
  3. Use encrypted communication when possible

What to Include in Your Report

Our Response Process

  1. Acknowledgment: We’ll acknowledge receipt within 24 hours
  2. Assessment: Initial assessment within 72 hours
  3. Updates: Regular updates on progress
  4. Resolution: Coordinated disclosure after fix is available

Security Monitoring

Automated Security Checks

Our CI/CD pipeline includes:

Security Notifications

Compliance

Standards Compliance

This action is designed to support compliance with:

Audit Trail

Security Updates

Update Schedule

Staying Informed

Contact

For security-related questions or concerns:

Remember: Security is a shared responsibility. This action provides secure defaults and features for private registry authentication, but your overall security posture depends on proper configuration and following security best practices in your infrastructure, registry management, and deployment processes.