Ensure least-privilege access is enforced for Amazon ECR repositories used by EKS workloads

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Review the IAM permissions and ECR repository policies that apply to repositories used by EKS workloads, and verify that access is limited to approved node roles, Fargate pod execution roles, CI/CD identities, and administrative roles. Confirm that pull access is limited to the minimum ECR actions required for image retrieval, that push or administrative access is scoped only to the repositories and actions required, and that no unnecessary wildcard or broad cross-account access is present.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enforce least-privilege access for ECR repositories used by EKS workloads by separating image pull, image push, and repository administration into different IAM roles and policy scopes. Grant node roles and Fargate pod execution roles only the ECR permissions needed to authenticate and pull images, such as ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Scope CI/CD and administrator access to the specific repositories and actions they require, and review both IAM identity-based policies and ECR repository policies because ECR authorization can be affected by both. AWS also provides the AmazonEC2ContainerRegistryPullOnly managed policy for pull-only use cases. • Separate ECR access by role. Use different roles for node pulls, Fargate pulls, CI/CD pushes, and repository administration.