---
title: Amazon EKS VPC CNI network policy support should be enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Amazon EKS VPC CNI network policy
  support should be enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Amazon EKS VPC CNI network policy support should be enabled
 
## Description{% #description %}

Amazon EKS clusters should enable VPC CNI network policy support so that Kubernetes NetworkPolicy objects enforce Pod-to-Pod traffic restrictions through the VPC CNI data path. This feature is not enabled by default and requires a supported `vpc-cni` add-on version with `enableNetworkPolicy` set to `true`; without it, namespace segmentation and least-privilege traffic controls are not applied.

## Remediation{% #remediation %}

Update the managed `vpc-cni` add-on to a supported version and set `enableNetworkPolicy` to `true` in its configuration values, then apply the required Kubernetes NetworkPolicy objects. See [Configure your cluster for Kubernetes network policies](https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html) for the full procedure.

## References{% #references %}

- [Configure your cluster for Kubernetes network policies](https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html)
- [Managing the Amazon VPC CNI plugin for Kubernetes](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)