Running Amazon EKS Benchmark Assessments

Product Name

CIS-CAT Pro Assessor v4

Product Version



Mar 20, 2024


The CIS Amazon Elastic Kubernetes Service (EKS) Benchmark requires certain Linux environment variables to be in place before CIS-CAT Pro Assessor can conduct a scan successfully. If these are not set correctly, Recommendations in the report may contain unexpected Fail or Unknown results.

As of Mar 20, 2024 and Amazon EKS Benchmark version 1.4.0, the “Worker Node Configuration Files“ category does not yet feature any Artifact Expressions. Consequently, CIS-CAT Pro Assessor will not collect evidence data for these Recommendations and return a “Manual” result for the applicable items.


Ensure that all other prerequisites (such as kubectl and the AWS CLI) are in place and properly configured as outlined in the CIS-CAT Pro Assessor Configuration Guide:

Then set the following environment variables on the system hosting Assessor:

  • export NODE_NAME=(node name)

    • Example: export NODE_NAME=ip-172-31-125-147.ec2.internal

  • export CLUSTER_NAME=(cluster name)

    • Example: export CLUSTER_NAME=eks-cluster-test-a1

  • export REGION_CODE=(region code)

    • Example: export REGION_CODE=us-east-1

When invoking Assessor, add the -E (or --preserve-env) parameter to sudo to retain the set values.
The below example will use the “Level 1 - Cluster / Control Plane” Profile:

sudo -E ./ -b "benchmarks/CIS_Amazon_Elastic_Kubernetes_Service_(EKS)_Benchmark_v1.4.0-xccdf.xml" -p "xccdf_org.cisecurity.benchmarks_profile_Level_1_-_Cluster__Control_Plane"

Keywords; amazon eks

Content by Label

Copyright © 2024

Center for Internet Security®