diff --git a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/apply/__init__.py b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/apply/__init__.py
index 8498ccaaa6cc2..038d379f8478a 100644
--- a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/apply/__init__.py
+++ b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/apply/__init__.py
@@ -12,6 +12,7 @@
 outdir = os.environ.get('TEST_OUTDIR', '/tmp')
 kubeconfig = os.path.join(outdir, 'kubeconfig')
 
+
 def apply_handler(event, context):
     logger.info(json.dumps(event))
 
@@ -35,6 +36,9 @@ def apply_handler(event, context):
     logger.info(f'Running command: {cmd}')
     subprocess.check_call(cmd)
 
+    if os.path.isfile(kubeconfig):
+        os.chmod(kubeconfig, 0o600)
+
     # write resource manifests in sequence: { r1 }{ r2 }{ r3 } (this is how
     # a stream of JSON objects can be included in a k8s manifest).
     manifest_list = json.loads(manifest_text)
diff --git a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/get/__init__.py b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/get/__init__.py
index 6058c8371e5bd..4fb3b162765ca 100644
--- a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/get/__init__.py
+++ b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/get/__init__.py
@@ -13,6 +13,7 @@
 outdir = os.environ.get('TEST_OUTDIR', '/tmp')
 kubeconfig = os.path.join(outdir, 'kubeconfig')
 
+
 def get_handler(event, context):
     logger.info(json.dumps(event))
 
@@ -30,6 +31,9 @@ def get_handler(event, context):
         '--kubeconfig', kubeconfig
     ])
 
+    if os.path.isfile(kubeconfig):
+        os.chmod(kubeconfig, 0o600)
+
     object_type         = props['ObjectType']
     object_name         = props['ObjectName']
     object_namespace    = props['ObjectNamespace']
diff --git a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py
index 67171b11aeede..17208a075d01f 100644
--- a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py
+++ b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py
@@ -12,6 +12,7 @@
 outdir = os.environ.get('TEST_OUTDIR', '/tmp')
 kubeconfig = os.path.join(outdir, 'kubeconfig')
 
+
 def helm_handler(event, context):
     logger.info(json.dumps(event))
 
@@ -38,6 +39,9 @@ def helm_handler(event, context):
         '--kubeconfig', kubeconfig
     ])
 
+    if os.path.isfile(kubeconfig):
+        os.chmod(kubeconfig, 0o600)
+
     # Write out the values to a file and include them with the install and upgrade
     values_file = None
     if not request_type == "Delete" and not values_text is None:
diff --git a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/patch/__init__.py b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/patch/__init__.py
index 6597341a4806d..a18455663b7f3 100644
--- a/packages/@aws-cdk/aws-eks/lib/kubectl-handler/patch/__init__.py
+++ b/packages/@aws-cdk/aws-eks/lib/kubectl-handler/patch/__init__.py
@@ -12,6 +12,7 @@
 outdir = os.environ.get('TEST_OUTDIR', '/tmp')
 kubeconfig = os.path.join(outdir, 'kubeconfig')
 
+
 def patch_handler(event, context):
     logger.info(json.dumps(event))
 
@@ -29,6 +30,9 @@ def patch_handler(event, context):
         '--kubeconfig', kubeconfig
     ])
 
+    if os.path.isfile(kubeconfig):
+        os.chmod(kubeconfig, 0o600)
+
     resource_name = props['ResourceName']
     resource_namespace = props['ResourceNamespace']
     apply_patch_json = props['ApplyPatchJson']