Ensure that default service accounts are not actively used

Cómo se verifica

Método de auditoría: Comando de shell

sa=$(kubectl get serviceaccounts -A -o go-template='{{range .items}}{{if eq .metadata.name "default"}}{{.metadata.namespace}} {{.automountServiceAccountToken}}{{"\n"}}{{end}}{{end}}') || exit 1
rb=$(kubectl get rolebindings,clusterrolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{$bn:=.metadata.namespace}}{{range .subjects}}{{if eq .kind "ServiceAccount"}}{{if eq .name "default"}}{{if .namespace}}{{.namespace}}{{else}}{{$bn}}{{end}} {{$b}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$sa" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && $2!="false" {print "automount: " $1}')
bad2=$(printf '%s\n' "$rb" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex {print "binding: " $0}')
if [ -z "$bad$bad2" ]; then echo compliant; else printf '%s\n%s\n' "$bad" "$bad2" | grep . | head -n 25; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Apply the following steps to replace default service-account usage with dedicated, least-privileged workload identities in AKS: • Update workloads to explicitly set a dedicated serviceAccountName instead of inheriting the namespace default service account. • Remove unnecessary RoleBinding and ClusterRoleBinding assignments from the default service account, and keep any remaining access minimal and namespace-scoped. • Set automountServiceAccountToken to false where Kubernetes API access is not required to prevent default token auto-mounting. • Review both the ServiceAccount and Pod settings for automountServiceAccountToken, and treat the Pod value as authoritative when both are defined. • For workloads that need Azure resource access, use Microsoft Entra Workload ID with explicit workload configuration instead of the namespace default service account.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aks