Restrict ECR access for EKS runtime identities to pull-only permissions

MediumLevel 1Manual revieweks

Description

Restricting ECR access for EKS runtime identities to pull-only permissions helps ensure that the identities used to run workloads can retrieve required container images without also receiving broader registry visibility or administrative access. In EKS, this applies to worker node IAM roles and, for Fargate workloads, the pod execution role that pulls images from private ECR repositories. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review the IAM role permissions and any ECR repository policies that apply to the runtime identities used by EKS to pull images, and verify that those identities are limited to pull-only access. Focus on the worker node IAM role for node-based workloads and the pod execution role for Fargate workloads.

How it is fixed

Fix method: Guidance or infrastructure patch

Enforce pull-only ECR access for EKS runtime identities by limiting the worker node IAM role, and where applicable the Fargate pod execution role, to only the permissions required to authenticate to ECR and retrieve container image layers. The runtime pull path only needs ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Broader policies such as AmazonEC2ContainerRegistryReadOnly or AmazonEC2ContainerRegistryFullAccess expose additional repository visibility or administration capabilities that are not required just to start workloads. • Identify the runtime roles in scope. Review the node IAM role for node-based workloads and the pod execution role for Fargate workloads, because those are the identities used to pull private ECR images. • Remove broader ECR managed policies from runtime roles.

Properties

Operating systems: Any
Tags: eksmanaged-servicesregistryfile-permissions
Reference: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.1.3 Restrict ECR access for EKS runtime identities to pull-only permissions