<p>I was going by this update for EKS <a href="https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/" rel="nofollow noreferrer">https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/</a> and this blog from AWS <a href="https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/</a>.</p>
<p>This is a very cryptic line which never confirms whether EKS encrypts secrets or not by default</p>
<blockquote>
<p>In EKS, we operate the etcd volumes encrypted at disk-level using AWS-managed encryption keys.</p>
</blockquote>
<p>I did understand that:-</p>
<ul>
<li>KMS with EKS will provide envelope encryption,like encrypting the DEK using CMK.</li>
<li>But it never mentioned that if I don't use this feature ( of course KMS will cost ), does EKS encrypts data by default?</li>
</ul>
<p>Because Kubernetes by default does not encrypt data . <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Source</a></p>
<blockquote>
<p>Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.</p>
</blockquote>

<p>I think I found it, the blog and update post by aws are very cryptic.</p>
<p>According to <a href="https://docs.aws.amazon.com/eks/latest/userguide/clusters.html" rel="nofollow noreferrer">docs</a> and console :-</p>
<blockquote>
<p>All of the data stored by the etcd nodes and associated Amazon EBS volumes is encrypted using AWS KMS.</p>
</blockquote>
<p>Using KMS with EKS is additional encryption or a better way of envelope encryption. It allows deploying a defense-in-depth strategy for Kubernetes applications by encrypting Kubernetes secrets with a KMS key that you define and manage.</p>
<p><a href="https://i.stack.imgur.com/CVMJG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CVMJG.png" alt="enter image description here" /></a></p>
