TMA-EKS-4.4.1
Prefer exposing secrets as mounted files rather than environment variables
Description
Secrets for EKS workloads are better exposed as mounted files than as environment variables. Kubernetes secrets can be consumed either way, and AWS supports file-based delivery from AWS Secrets Manager and Parameter Store through the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports containers using env valueFrom.secretKeyRef or envFrom.secretRef.
How it is checked
Audit method: Shell command
out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{range .spec.initContainers}}{{$c:=.name}}{{range .env}}{{if .valueFrom}}{{if .valueFrom.secretKeyRef}}{{$ns}} {{$p}} {{$c}} env{{"\n"}}{{end}}{{end}}{{end}}{{range .envFrom}}{{if .secretRef}}{{$ns}} {{$p}} {{$c}} envFrom{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && (1)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Update workloads to consume secrets as mounted files instead of environment variables. Replace env[].valueFrom.secretKeyRef and envFrom[].secretRef usage with Kubernetes Secret volumes or the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, then update the application to read the secret from the mounted file path. This reduces the chance of secret values appearing in logs and aligns with the AWS-recommended file-based delivery pattern for EKS workloads. Replace secret environment variables with mounted secret files and update the application to read from the mounted path.
Properties
- Operating systems
- Any
- Tags
- ekspoliciessecrets
- Reference
- CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.4.1 Prefer exposing secrets as mounted files rather than environment variables
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target eks