Skip to main content
Source

This page is generated from devops-agent/eks-security/references/compliance-regimes.md. Edit the source, not this page.

Compliance Regimes — Scope, Nuance & Worked Scenarios

The cross-cutting view over the 7-layer stack. Compliance status changes over time — every claim here must be re-verified against the live AWS Services in Scope page before it goes into a customer-facing document. The table below is a map to verify against, not a substitute for the live page.

EKS compliance-scope table​

ProgramStatusNotes
PCI DSS Level 1✅ Natively in scopeCustomer owns workload-level controls (segmentation, access, logging, vuln mgmt)
HIPAA✅ EligibleRequires a signed BAA with AWS before processing PHI
SOC 1 / 2 / 3✅ In scopeReports in AWS Artifact
ISO 27001 / 27017 / 27018 / 9001✅ In scopeReports in AWS Artifact
FedRAMP Moderate✅ In scopeCommercial regions
FedRAMP High✅ In scopeGovCloud only (us-gov-east-1, us-gov-west-1)
HITRUST CSF✅ In scopeHealthcare-focused
IRAP / C5 / K-ISMS / ENS High / OSPAR✅ In scopeRegional government programs (AU / DE / KR / ES / SG)
DISA IL4 / IL5✅ In scope — GovCloud onlyDoD Impact Levels 4 & 5 are GovCloud-only; commercial regions reach IL2 only. Don't imply IL5 works in commercial.
GDPR / data residencyAlignment / frameworkAWS provides DPA + enablers; no independent GDPR certification; customer owns workload controls
NIST SP 800-53 / 800-171Alignment / frameworkAWS Config conformance packs ("Operational Best Practices for NIST 800-53 rev 5"; "...NIST 800 171") — Audit Manager maintenance mode
CJISAlignment / frameworkArchitectural enablers

Language precision (these are graded by auditors):

  • EKS is "HIPAA-eligible", never "HIPAA-compliant" — the customer signs a BAA and owns workload-level controls. "HIPAA-compliant" implies an attestation AWS does not provide.
  • FedRAMP Moderate ≠ High. Moderate = commercial regions; High = GovCloud only. Promising High in commercial regions is a guaranteed audit failure.
  • For alignment/framework regimes (GDPR, NIST, CJIS), AWS provides enablers but no independent attestation — say so explicitly.

Per-regime quick guidance​

The three most common regimes have dedicated quick-starts (control-mapping tables + 30/60/90 + shared responsibility): HIPAA → compliance-hipaa.md · PCI DSS → compliance-pci.md · SOC 2 → compliance-soc2.md. The bullets below are the at-a-glance version for these plus FedRAMP/GDPR.

  • HIPAA (deep-dive) — confirm an active BAA first; enable all 5 control-plane log types for forensic depth; 6-year documentation retention (§164.316(b)(2); no fixed audit-log floor, but retention is commonly aligned to it as a conservative practice); CMK for EBS/S3/EFS holding PHI; AWS Config conformance pack "Operational Best Practices for HIPAA Security" + Security Hub (AWS Audit Manager in maintenance mode, closed to new accounts, existing setups continue — see compliance-accelerators.md); accept the BAA in AWS Artifact (Agreements) and pull supporting SOC 2/ISO reports for evidence — there is no HIPAA AOC to download.
  • PCI-DSS (deep-dive) — 1-year audit-log retention minimum; render stored PAN unreadable — tokenize / keyed cryptographic hash of the entire PAN (Req 3.5.1.1; keyed condition mandatory since 31 Mar 2025) / strong crypto (disk-CMK alone is not sufficient) + no PAN in logs (Req 3) and mTLS for CHD crossing untrusted networks (Req 4); default-deny NetworkPolicy + Security Groups for Pods to segment cardholder-data namespaces (Req 1); ECR Enhanced Scanning (Req 6 + 11) + quarterly ASV external scan + annual penetration test + segmentation testing (Req 11.4.5, at least every 12 months; Req 11.4.6, every 6 months for service providers); Security Hub PCI-DSS pack; PCI AOC from Artifact.
  • SOC 2 (deep-dive) — an attestation, not a certification; AWS's SOC report (Artifact) is a subservice carve-out, not the customer's own SOC 2; select the applicable Trust Services Categories (Security / Common Criteria always required); Type II grades operating effectiveness over an observation window (commonly 3–12 months, defined by the service organization in coordination with its auditor; 3–6 often used for a first Type II), so instrument logging early.
  • FedRAMP — Moderate (commercial) vs High (GovCloud) is the first question (AWS's FedRAMP page now labels these Class C, formerly Moderate, and Class D, formerly High; the Config pack names below are unchanged); CMK for all data layers; VPC private endpoints to keep traffic on the AWS backbone; AWS Config conformance packs "Operational Best Practices for FedRAMP(Moderate)" (High is split into "Operational Best Practices for FedRAMP (High Part 1)" and "...(High Part 2)"; there is no bare "FedRAMP" pack) (AWS Audit Manager in maintenance mode, closed to new accounts, existing setups continue — see compliance-accelerators.md); confirm the authorizing agency for the customer's account.
  • GDPR — EU-only residency is a customer policy choice, not a GDPR mandate: GDPR permits transfers outside the EEA under an adequacy decision or appropriate safeguards (SCCs), which AWS applies automatically (AWS GDPR Center) — though post-Schrems II the data exporter (controller or, where applicable, processor) still owes a transfer-impact assessment + supplementary measures where needed (EDPB Rec 01/2020), and sector/member-state law may mandate residency independently of GDPR. If the customer's data-residency policy requires it, keep clusters + all data layers + CloudWatch/CloudTrail EU-region-only with no non-EU replication; download the DPA from Artifact; the customer owns Article-17 erasure, DPIAs, and breach notification (Articles 33-34).

Worked scenarios (decision shape, not copy-paste)​

1 — HIPAA greenfield, open to AWS defaults​

Bottlerocket + Pod Identity + Access Entries + PSA restricted + Kyverno + VPC CNI NetworkPolicy + Security Groups for Pods + ECR Enhanced Scanning + Cosign + GuardDuty for EKS + all 5 control-plane logs + CMK on PHI data layers + AWS Config conformance pack "Operational Best Practices for HIPAA Security" + Security Hub (AWS Audit Manager in maintenance mode, closed to new accounts, existing setups continue — see compliance-accelerators.md). Confirm the BAA is active before anything else. 30/60/90: provision + enable logging/Config conformance pack → onboard first PHI workload + validate Pod Identity/Access Entries/Kyverno/NetworkPolicy → HIPAA mock audit + remediate + confirm the signed BAA (Artifact Agreements) + supporting SOC 2 report (no HIPAA AOC exists).

2 — Vendor-OS mandate (RHEL), FedRAMP Moderate, federal​

Layer 1 = custom CIS-hardened RHEL AMI on self-managed nodes via Image Builder (customer owns RHEL hardening + patch cycle), or ROSA if they want Red-Hat-managed OpenShift (separate product — defer to ROSA + Red Hat partner). Layers 2-7 identical to the canonical stack. FedRAMP nuance: Moderate = commercial regions; CMK for all data layers; VPC private endpoints. Surface Bottlerocket as the AWS-canonical alternative if the mandate is a support contract rather than specific RHEL features — without pushing past the mandate. Escalate if the customer needs FedRAMP High (GovCloud + partner).

3 — PCI-DSS existing-cluster hardening, audit in 4 months​

Priority-ordered (not big-bang): Weeks 1-2 enable logging + GuardDuty + ECR scanning + Security Hub PCI pack + kube-bench baseline (non-disruptive). Weeks 3-6 aws-auth → Access Entries (change window), audit IRSA least-privilege. Weeks 7-10 PSA restricted (audit→enforce), Kyverno PCI policies, default-deny NetworkPolicy + SGP on the cardholder-data namespace (Req 1); render stored PAN unreadable — tokenize / keyed cryptographic hash of the entire PAN (Req 3) + mTLS for CHD in transit over open/public networks (Req 4). Weeks 11-14 migrate AL2→AL2023/Bottlerocket (AL2 OS reached EOL 2026-06-30 — already unsupported). Weeks 15-16 AWS Config conformance packs "Operational Best Practices for PCI DSS 4.0 (Excluding global resource types)" / "...(Including global resource types)" (deploy the Including variant only in the global resources' home Region — us-east-1 in the commercial partition, the only Region where its CloudFront/WAF/Shield rules find recorded configuration items — and the Excluding variant in every other Region) + Security Hub PCI pack + remediate + pull PCI AOC (AWS's attestation of the AWS-managed layer; the customer still undergoes its own PCI assessment) + schedule the quarterly ASV scan and segmentation testing (every 6 months as a service provider) (AWS Audit Manager in maintenance mode, closed to new accounts, existing setups continue — see compliance-accelerators.md). Map controls to PCI Requirements 1/2/3/4/6/7/8/10/11.

4 — GDPR / EU data residency​

GDPR is alignment/framework — no AWS certification, and EU-only residency is a customer policy choice, not a GDPR requirement (transfers outside the EEA are lawful under an adequacy decision or SCCs, which AWS applies automatically — subject to a post-Schrems II transfer-impact assessment + supplementary measures where needed; sector/member-state law may require residency independently of GDPR). Architecture when the customer's residency policy requires EU-only: EKS + all data layers in EU regions only; no non-EU replication; EU-region logs; VPC endpoints to avoid egress via non-EU edges; AWS European Sovereign Cloud for highest assurance (limited region/service coverage — verify). Standard 7-layer baseline otherwise. Customer owns Article-17 erasure, DPIAs, breach notification; AWS provides the DPA (Artifact).

5 — EKS Auto Mode for a compliance-sensitive workload​

The crux: is a CIS-hardened custom AMI a hard regulatory requirement or an organizational preference? Auto Mode doesn't support custom AMIs (or Cilium) as of 2026-07-17.

  • Hard requirement → Auto Mode not viable → Bottlerocket on self-managed Karpenter NodePools.
  • Preference → Auto Mode viable → lead with its reduced-permission node IAM (AmazonEKSWorkerNodeMinimalPolicy) as a HIPAA differentiator.
  • Most compliance-sensitive customers land on Bottlerocket + Karpenter as the compromise (immutable OS + custom-AMI control + consolidation). Layers 2-7 are identical regardless of the Layer-1 choice.

Escalate (compliance-specific)​

First-time certification on a mission-critical regulated workload; XXL+ segment; FedRAMP High/GovCloud; Top Secret/Secret (out of scope); EKS Anywhere/Hybrid Nodes inside a FedRAMP boundary; multi-tenant SaaS with cross-tenant PHI/cardholder/federal isolation; customer-vs-auditor disagreement on AWS-managed-control acceptability; written legal commitments beyond Artifact; or any claim you cannot ground in an AWS-published source.

Sources​