AWS has published a security architecture for tenants on a shared Amazon EKS cluster that puts namespace-scoped mutual TLS in front of protocols with no authentication of their own, using a case study built around Android Debug Bridge and WebRTC streaming.

The AWS Security Blog post, published on 6 November, describes a deployment where each tenant namespace runs its own Envoy Gateway. cert-manager requests short-lived client certificates for each namespace from AWS Private CA, with a 12-hour lifetime and a 4-hour renewal window. A custom API validates each user’s JWT against the enterprise identity provider, confirms the namespace assignment and returns the certificate and connection details. AWS says the API logs identity, namespace and timestamp for every session.

Why it matters

AWS lists controls that must already be in place. A default-deny NetworkPolicy in each tenant namespace comes first, because without it traffic can bypass the gateway. The post also flags three limits. The hop between Envoy and the pod is not encrypted by mTLS, the ADB data path has no WAF protection, and the certificate carries no user identifier in its subject, so attribution rests on the API log unless each user gets a certificate of their own. AWS says short lifetimes avoid CRL or OCSP infrastructure, and that a threat model needing immediate revocation requires CRL or OCSP infrastructure on top of AWS Private CA.

The post calls the custom API “the primary trust boundary in this architecture” and says it deserves the same review, logging and access controls as any authentication service.

What to do

In our reading, teams running shared clusters can use the post as a checklist for any internal protocol that trusts the network, such as VNC, RDP or MQTT, which AWS names as candidates for the same wrapper. Start with the NetworkPolicy. Earlier CyberTech opinion pieces on keeping management interfaces on a network only administrators reach and on reading SSH access policy as a map of what one stolen device can reach make the same case for access paths.

Source: AWS Security Blog, Addressing protocol security gaps in multi-tenant Kubernetes