Difference between EKS AMI and Bottle Rocket

Question

What is the difference between and eks based ami (amazon-eks-node-1.29) and an bottle rocket one ( bottlerocket-aws-k8s-1.29) ? Are they basically the same just the bottle rocket is more locked down/hardened? Would they both work in GovCloud environments? For security compliance, the bottle rocket would be better for CIS results?

Accepted Answer

The main difference between the Amazon EKS-optimized AMI (`amazon-eks-node-1.29`) and the Bottlerocket AMI (`bottlerocket-aws-k8s-1.29`) lies in their purpose, architecture, and security posture.

1. **Purpose**:
   - The Amazon EKS-optimized AMI is a general-purpose Amazon Machine Image (AMI) that includes the Amazon EKS worker node binaries and dependencies required to run Kubernetes workloads on Amazon EC2 instances.
   - Bottlerocket is a Linux-based open-source operating system designed specifically for running containers on virtual machines or bare metal hosts. It is optimized for hosting container workloads, with a focus on security and maintainability.

2. **Architecture**:
   - The Amazon EKS-optimized AMI is based on Amazon Linux 2, which is a general-purpose Linux distribution.
   - Bottlerocket is a purpose-built container-optimized operating system that has a minimized attack surface and reduced overhead compared to traditional Linux distributions.

3. **Security**:
   - The Amazon EKS-optimized AMI provides a standard level of security for a general-purpose Linux distribution.
   - Bottlerocket is designed with security as a core principle, featuring read-only file systems, automatic updates, and a minimal set of packages and services running by default. This hardened approach can improve the overall security posture and compliance with security standards like CIS benchmarks.

4. **GovCloud Environments**:
   - Both the [Amazon EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/retrieve-ami-id.html) and [Bottlerocket AMI](https://docs.aws.amazon.com/eks/latest/userguide/retrieve-ami-id-bottlerocket.html) should work in the [AWS GovCloud](https://docs.aws.amazon.com/general/latest/gr/eks.html) region.

5. **Security Compliance**:
   - For security compliance requirements, such as CIS benchmarks, Bottlerocket may have an advantage due to its more hardened and minimalistic design. However, the specific compliance requirements and the level of hardening needed should be evaluated on a case-by-case basis.

In summary, while both AMIs can be used to run Kubernetes workloads in AWS, Bottlerocket is more specialized, hardened, and optimized for running containers, which can provide better security and potentially better compliance with security standards. However, the Amazon EKS-optimized AMI is a more general-purpose option that may be suitable for many use cases as well.

Answer

The main difference between an **EKS-based AMI (Amazon EKS Node)** and a **Bottlerocket AMI (Bottlerocket AWS K8s)** lies in their design and optimization. **EKS-based AMIs** are optimized for compatibility and flexibility, while **Bottlerocket AMIs** are optimized for security, efficiency, and minimalism, making them more locked down and hardened.

Both AMIs should work in *GovCloud* environments, but for security compliance, the **Bottlerocket AMI** is likely better suited due to its focus on security and minimal attack surface, which could result in better *CIS benchmark results*.

Difference between EKS AMI and Bottle Rocket

Relevant content