Minimize access to the proxy sub-resource of nodes

HighLevel 1Manual revieweks

Description

Access to the nodes/proxy subresource in EKS should be limited to identities with a documented node-administration or troubleshooting need. This review should cover custom Role and ClusterRole rules, RoleBinding and ClusterRoleBinding assignments, and any service accounts that receive node subresource access. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review EKS RBAC to identify custom Role and ClusterRole objects that grant access to the nodes/proxy subresource, and validate that each permission is required for an approved troubleshooting, maintenance, or platform-administration function. Focus this review on customer-managed RBAC because EKS creates its own default RBAC identities for cluster components, while customer-defined node-proxy access is usually introduced through native Kubernetes RBAC.

How it is fixed

Fix method: Guidance or infrastructure patch

Reduce custom RBAC access to the nodes/proxy API path so it is limited to approved administrative identities that require node-level access. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve custom Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep nodes/proxy limited to tightly controlled troubleshooting, maintenance, or platform-administration use cases, and avoid assigning it to workload service accounts. • Remove nodes/proxy from any custom Role or ClusterRole where node-level proxying is not explicitly required. • Where some node-related access is still needed, replace nodes/proxy with narrower permissions on only the specific resources and verbs required, and reduce scope from ClusterRole to namespace-scoped Role where the function allows it.

Properties

Operating systems: Any
Tags: ekspoliciesrbac
Reference: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.10 Minimize access to the proxy sub-resource of nodes