Minimize access to webhook configuration objects

HochStufe 1Manuelle Prüfungeks

Beschreibung

Access to ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects in EKS should be limited to tightly controlled cluster-administrative identities. These objects define admission webhooks that intercept Kubernetes API requests before they are accepted, and they apply at cluster scope rather than namespace scope. The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Audit this control by identifying who can manage cluster-scoped ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources, and confirm that webhook definitions are limited to approved admission use cases in EKS. Review whether cluster access is managed through access entries and associated access policies or through Kubernetes groups and native RBAC, because EKS access entries are the primary cluster access model and Kubernetes-group authorization still depends on manually managed Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Remove permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and rebind that access only to tightly controlled cluster-administrative identities. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve native Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep webhook-configuration management limited to a small set of approved administrative identities, because these objects sit directly in the admission path and operate at cluster scope. • Remove create, update, patch, and delete permissions on validatingwebhookconfigurations and mutatingwebhookconfigurations from broad custom ClusterRole and Role assignments.

Eigenschaften

Betriebssysteme: Beliebig
Tags: ekspoliciesrbac
Referenz: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects