Minimize access to webhook configuration objects

HighLevel 1Manual revieweks

Description

Access to ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects in EKS should be limited to tightly controlled cluster-administrative identities. These objects define admission webhooks that intercept Kubernetes API requests before they are accepted, and they apply at cluster scope rather than namespace scope. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Audit this control by identifying who can manage cluster-scoped ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources, and confirm that webhook definitions are limited to approved admission use cases in EKS. Review whether cluster access is managed through access entries and associated access policies or through Kubernetes groups and native RBAC, because EKS access entries are the primary cluster access model and Kubernetes-group authorization still depends on manually managed Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects.

How it is fixed

Fix method: Guidance or infrastructure patch

Remove permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and rebind that access only to tightly controlled cluster-administrative identities. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve native Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep webhook-configuration management limited to a small set of approved administrative identities, because these objects sit directly in the admission path and operate at cluster scope. • Remove create, update, patch, and delete permissions on validatingwebhookconfigurations and mutatingwebhookconfigurations from broad custom ClusterRole and Role assignments.

Properties

Operating systems: Any
Tags: ekspoliciesrbac
Reference: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects