✓ Human-authored analysis; AI used for formatting and proofreading.
The question that's still open
In February 2017, kops issue #1776 asked: "What is kops missing to support a HIPAA compliant cluster?"
The issue is still open. The discussion produced one of the most practical HIPAA checklists for AWS infrastructure, contributed by engineers running PHI workloads:
"ePHI/PII over the wire must be encrypted. ePHI/PII sitting on disk is encrypted. Basically, anything that does NOT need to be open/public/unrestricted needs to be closed/private/restricted."
The checklist covers 6 domains: data encryption, access control, audit logging, network security, compute security, and operational procedures. Most of these are still valid requirements in 2026.
The checklist mapped to Stave
Here's every technical requirement from the kops discussion, mapped against what Stave evaluates today:
Data Encryption
| Requirement | HIPAA Section | Stave Status | Control |
|---|---|---|---|
| ePHI encrypted at rest (S3) | §164.312(a)(2)(iv) | Covered | CTL.S3.ENCRYPT.001 |
| CMK instead of AWS-managed key | §164.312(a)(2)(iv) | Covered | CONTROLS.001.STRICT |
| Encrypted EBS volumes | §164.312(a)(2)(iv) | Covered | CTL.EC2.EBS.DEFAULT.001 |
| Encrypted EBS root AMI | §164.312(a)(2)(iv) | Covered | CTL.EC2.AMI.ENCRYPTION.001 |
| etcd encryption at rest | §164.312(a)(2)(iv) | Covered | CTL.K8S.ETCD.CERT.001 |
| S3 transport encryption (TLS) | §164.312(e)(2)(ii) | Covered | CTL.S3.ENCRYPT.002 |
| Network encryption (pod-to-pod) | §164.312(e)(1) | Covered | CTL.K8S.NETPOL.001 |
Access Control
| Requirement | HIPAA Section | Stave Status | Control |
|---|---|---|---|
| S3 Public Access Block | §164.312(a)(1) | Covered | CTL.S3.CONTROLS.001 |
| No wildcard IAM actions | §164.312(a)(2)(i) | Covered | CTL.S3.ACCESS.002 |
| Root account MFA | §164.312(d) | Covered | CTL.IAM.ROOT.MFA.001 |
| Console user MFA | §164.312(d) | Covered | CTL.IAM.CONSOLE.MFA.001 |
| No root access keys | §164.312(a)(1) | Covered | CTL.IAM.ROOT.ACCESSKEY.001 |
| Unused credentials disabled | §164.312(a)(2)(i) | Covered | CTL.IAM.CRED.UNUSED.001 |
| Access key rotation (<90 days) | §164.312(a)(2)(i) | Covered | CTL.IAM.CRED.ROTATION.001 |
| No inline IAM policies | §164.312(a)(2)(i) | Covered | CTL.IAM.POLICY.INLINE.001 |
| Password policy (length, complexity) | §164.312(a)(2)(i) | Covered | CTL.IAM.PASSWORD.* |
| Default-deny security groups | §164.312(a)(1) | Covered | CTL.VPC.SG.DEFAULT.001 |
| Kubernetes RBAC enforcement | §164.312(a)(1) | Covered | CTL.K8S.RBAC.WILDCARD.001 |
| Pod security policies | §164.312(a)(1) | Covered | CTL.K8S.POD.PRIVILEGED.001 |
Audit & Logging
| Requirement | HIPAA Section | Stave Status | Control |
|---|---|---|---|
| S3 access logging | §164.312(b) | Covered | CTL.S3.LOG.001 |
| CloudTrail S3 data events | §164.312(b) | Covered | CTL.S3.AUDIT.OBJECTLEVEL.001 |
| VPC flow logging | §164.312(b) | Covered | CTL.VPC.FLOWLOG.001 |
| Kubernetes audit logging | §164.312(b) | Covered | CTL.K8S.AUDIT.001 |
| kops/kubectl action logging | §164.312(b) | Not covered | Operational — tool-specific |
| File system auditing (OSSEC) | §164.312(b) | Not covered | Runtime agent — not config |
Network Security
| Requirement | HIPAA Section | Stave Status | Control |
|---|---|---|---|
| VPC endpoint for S3 | §164.312(e)(1) | Covered | CTL.S3.NETWORK.VPC.001 |
| VPC endpoint policy | §164.312(e)(1) | Covered | CTL.S3.NETWORK.POLICY.001 |
| Private topology (no public IPs) | §164.312(e)(1) | Covered | CTL.EC2.PUBLIC.001 |
| Restricted egress | §164.312(e)(1) | Covered | CTL.K8S.NETPOL.EGRESS.001 |
| Network policy enforcement | §164.312(e)(1) | Covered | CTL.K8S.NETPOL.DENY.001 |
Data Integrity & Retention
| Requirement | HIPAA Section | Stave Status | Control |
|---|---|---|---|
| S3 versioning | §164.312(c)(1) | Covered | CTL.S3.VERSION.001 |
| S3 Object Lock (compliance mode) | §164.316(b)(2) | Covered | CTL.S3.LOCK.001/002/003 |
| S3 lifecycle rules | §164.316(b)(2) | Covered | CTL.S3.LIFECYCLE.001/002 |
| Backup encryption | §164.312(a)(2)(iv) | Covered | CTL.RDS.ENCRYPT.BACKUP.001 |
| Backup testing | §164.308(a)(7) | Not covered | Operational — cadence policy |
Operational (Policy-based, not technical)
| Requirement | HIPAA Section | Stave Status | Notes |
|---|---|---|---|
| Unique user identification | §164.312(a)(2)(i) | Partially | IAM controls, not K8s users |
| Emergency access procedure | §164.312(a)(2)(ii) | Not covered | Operational policy |
| Auto-logoff | §164.312(a)(2)(iii) | Not covered | Application-level |
| Security incident reporting | §164.308(a)(6) | Not covered | Operational policy |
| User off-boarding | §164.308(a)(3) | Not covered | Operational policy |
| Malware protection | §164.308(a)(5) | Not covered | Runtime security |
| BAA with AWS | §164.308(b) | Acknowledged | Disclaimer in every report |
Scorecard
| Domain | Total Checks | Stave Covers | Gap |
|---|---|---|---|
| Data Encryption | 7 | 7 | 0 |
| Access Control | 12 | 12 | 0 |
| Audit & Logging | 6 | 4 | 2 (kops action logging, filesystem auditing) |
| Network Security | 5 | 5 | 0 |
| Data Integrity | 5 | 4 | 1 (backup testing cadence) |
| Operational | 7 | 0 | 7 (policy-based, not technical) |
| Total | 42 | 32 | 10 |
Stave covers 32 of 42 requirements across S3, IAM, EBS, EC2, VPC, RDS, ELB, and Kubernetes. The 10 remaining gaps are operational procedures (7), runtime agents (2 — filesystem auditing, kops action logging), and backup testing cadence (1). None of these are infrastructure configuration that Stave's evaluation model addresses.
Out of scope (operational)
These requirements are policy-based, not infrastructure-based. Stave evaluates technical controls only:
- Emergency access procedures
- User off-boarding processes
- Security incident reporting
- Malware protection
- Backup testing cadence
- Auto-logoff configuration
- kops/kubectl action logging (tool-specific operational logging)
- File system auditing / OSSEC (runtime agent, not config)
Stave's HIPAA report includes the BAA disclaimer: "Stave evaluates technical controls only. A BAA with AWS is a contractual prerequisite for HIPAA compliance that Stave cannot verify."
What Stave already does beyond the kops checklist
The kops discussion focused on infrastructure configuration. Stave adds dimensions the checklist doesn't cover:
- Compound risk detection — public access + wildcard actions = lateral movement
- Duration tracking — how long has each misconfiguration persisted?
- CMK vs AWS-managed key — the breach response distinction
- Object Lock compliance mode — not just "enabled" but which mode
- Presigned URL restrictions — controls the kops checklist never mentions
- Acknowledged exceptions — documented risk acceptance with compensating controls
- Proof of pass — logic trace proving why something is compliant
- Offline evaluation — air-gapped, deterministic, no credentials needed
The coverage
Stave covers 32 of 42 requirements from the kops HIPAA checklist across S3, IAM, EBS, EC2, VPC, RDS, ELB, and Kubernetes. The catalog now includes 3,558 controls with compound risk detection, duration tracking, and HIPAA citations.
The 10 remaining gaps are operational procedures and runtime agents that fall outside infrastructure configuration evaluation. Every technical requirement from the original 2017 discussion is covered.
The kops HIPAA discussion referenced in this article is github.com/kubernetes/kops/issues/1776.
