Minimize wildcard use in Roles and ClusterRoles

MittelStufe 1Manuelle Prüfungeks-auto

Beschreibung

Verify that Kubernetes Role and ClusterRole objects in EKS Auto Mode do not use wildcard entries such as * for verbs, resources, or apiGroups unless a documented administrative or platform requirement exists. The review should also include the RoleBinding and ClusterRoleBinding objects that assign those roles to users, groups, or service accounts, because EKS Auto Mode uses access entries for IAM principal access, but still supports native ... The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Begin by reviewing custom Kubernetes Role and ClusterRole objects in EKS Auto Mode to identify any use of wildcard entries such as * for verbs, resources, or apiGroups. In EKS, this review should cover native RBAC objects, access entries that reference Kubernetes groups, service accounts, and any remaining aws-auth mappings only where ConfigMap based access still applies, because EKS supports access through both access entries and Kubernetes RBAC, and it also creates its own platform RBAC objects that should be distinguished from customer defined permissions.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Begin by replacing wildcard permissions in custom Role and ClusterRole objects with explicitly enumerated verbs, resources, and apiGroups that match the approved operational need. In EKS, this remediation should focus on customer managed RBAC objects, the bindings that assign them, access entries that reference Kubernetes groups, and service accounts used by workloads or cluster components. EKS guidance favors specific access through access entries and using custom RBAC only when predefined access policies do not meet the requirement, especially for service accounts used by add-ons, DaemonSets, and CSI drivers. • Replace wildcard values in custom Role and ClusterRole rules with the specific verbs, resources, and apiGroups the function actually requires.

Eigenschaften

Betriebssysteme: Beliebig
Tags: eks-autopoliciesrbac
Referenz: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 4.1.3 Minimize wildcard use in Roles and ClusterRoles