Do EKS encrypts secrets by default?

Question

I was going by the following [documentation](https://aws.github.io/aws-eks-best-practices/security/docs/data/#secrets-management). After reading this I understood about using Kms with EKS, but I am not able to understand whether EKS encrypts secrets by default because kubernetes by default does not encrypt and stores secrets  in base64encoded format, however EKS uses AWS managed keys for EBS volumes used for  etcd nodes as mentioned in documentation.

Pretty confusing.
>Kubernetes secrets are used to store sensitive information, such as user certificates, passwords, or API keys. They are persisted in etcd as base64 encoded strings. On EKS, the EBS volumes for etcd nodes are encrypted with EBS encryption.

Answer

Kubernetes secrets are not encrypted by default in EKS even though the etcd EBS volumes themselves use encryption at rest. Technically they are not in clear text on the disk volumes, but they are in clear text (base64 encoded) in the etcd database.

You can enable envelope encryption using the AWS Encryption Provider. This will encrypt each secret using individual data keys which are in turn encrypted using a master key stored in KMS.

Background: https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/

How to enable on the cluster: https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html

Even with secrets encrypted you still need to control who can read these secrets in the cluster. You can use Secrets Manager integration with EKS to manage fine grained access to the secrets. https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver.html

Do EKS encrypts secrets by default?

Relevant content