Ensure that Service Account Tokens are only mounted where necessary

How it is checked

Audit method: Shell command

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}}{{range .spec.volumes}} {{.name}}{{end}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($0 ~ / kube-api-access-/)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Apply the following steps to reduce unnecessary service account token mounting in EKS: • Set automountServiceAccountToken to false for Pods and ServiceAccounts that do not require Kubernetes API access. This reduces unnecessary default token auto-mounting. • Update workloads to use a dedicated serviceAccountName only where a service account token is operationally required, instead of inheriting token behavior from the namespace default service account. Each application should use its own dedicated service account. • For workloads that need AWS access, use IRSA or EKS Pod Identity with a dedicated service account rather than broad default token mounting. Both models associate AWS permissions to a Kubernetes service account for a specific workload boundary.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target eks