🛡️ AWS EKS Node Group Linux AMI is outside support🟢

• Contextual name: 🛡️ Node Group Linux AMI is outside support🟢
• ID: /ce/ca/aws/eks/node-group-ami-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY, RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS EKS Cluster Node Group
  • 🔌 AWS EKS Cluster Node Group - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that Amazon EKS managed node groups use a maintained EKS-optimized Linux AMI family and Kubernetes-specific AMI stream. The policy uses the node group's AMI Type and Version reported by DescribeNodegroup. It does not require the newest AMI or treat image age, deprecation, or availability as proof of end of support.

Rationale

An unsupported AMI stream stops receiving AWS image updates, leaving nodes exposed to uncorrected vulnerabilities and reliability defects. Owners can resolve the finding by migrating to a maintained family or updating the node group's Kubernetes version and AMI. Extended support remains acceptable for this check; the separate Kubernetes-version policies identify versions outside standard support.

Impact

Migration replaces nodes and can disrupt workloads. Test bootstrap configuration, networking, container runtime assumptions, architecture, and GPU/Neuron drivers. A supported family does not establish that an individual image revision, installed package, or driver is current or supported.

... see more

Remediation

Open File

Remediation

1. Confirm the finding against current AWS inventory. Inspect the node group's amiType, releaseVersion, version, status, launchTemplate, and backing Auto Scaling groups:

   aws eks describe-nodegroup \
       --region {{region-name}} \
       --cluster-name {{cluster-name}} \
       --nodegroup-name {{node-group-name}}
   
   aws eks describe-cluster \
       --region {{region-name}} \
       --name {{cluster-name}} \
       --query 'cluster.{Version:version,Status:status}'
   
   aws eks describe-cluster-versions \
       --region {{region-name}} \
       --include-all

   Use the Auto Scaling group names from nodegroup.resources.autoScalingGroups to identify its EC2 instances. Inspect their actual ImageId values and Kubernetes node versions, particularly after an interrupted rollout. A private or deregistered AMI and missing CMDB enrichment do not establish end of support. For a custom launch-template AMI, verify its base OS, build provenance, patch process, and owner support separately.

2. Select a maintained EKS-optimized AL2023 or Bottlerocket family and AMI release compatible with the node-group Kubernetes version, instance architecture, and workload drivers. If the Kubernetes-specific AMI stream has reached final support, plan a compatible control-plane upgrade first where necessary, then update the managed nodes. A newer control plane alone does not fix the node image. Updating within AL2 cannot restore its retired family support.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data