---
title: Prefer exposing EKS secrets as mounted files rather than environment variables
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Prefer exposing EKS secrets as mounted
  files rather than environment variables
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Prefer exposing EKS secrets as mounted files rather than environment variables
 
## Description{% #description %}

AWS EKS clusters should deliver secrets to workloads as mounted files rather than environment variables, because environment variable values can unintentionally appear in logs while volume-mounted secrets are instantiated as tmpfs volumes and removed from the node when the Pod is deleted. This rule verifies that the AWS Secrets Store CSI Driver addon is installed on the cluster, which enables the AWS-recommended file-based secret delivery pattern through the AWS Secrets and Configuration Provider; per-workload inspection of `env[].valueFrom.secretKeyRef` and `envFrom[].secretRef` references is not available from cluster-level resources.

## Remediation{% #remediation %}

Install the Secrets Store CSI Driver together with the AWS Secrets and Configuration Provider, then update workloads to read secrets from mounted file paths instead of environment variables. See [Use AWS Secrets Manager secrets in Amazon EKS](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_ascp_irsa.html).

## References{% #references %}

- [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)