Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster

AltaNivel 1Revisión manualaks

Descripción

Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators Review AKS authorization assignments to ensure bind, escalate, and impersonation permissions are granted only to identities with a documented administrative need. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review AKS RBAC to identify any users, groups, or service accounts granted bind, escalate, or impersonation permissions through Kubernetes RBAC or Azure RBAC for Kubernetes Authorization. • Identify roles and bindings that include bind, escalate, or impersonation permissions. • Determine which users, groups, or service accounts receive those permissions. • Validate that each assignment is required for a defined administrative function. • Flag any cluster-scoped or service-account assignment that lacks a documented need.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remove bind, escalate, and impersonation permissions from any custom Role or ClusterRole that does not require them for an approved administrative function. Where these permissions are required, keep them limited to the smallest practical scope and avoid assigning them to workload service accounts, since AKS recommends minimum required permissions and service accounts continue to rely on Kubernetes RBAC. • Update each affected custom Role to remove unnecessary bind, escalate, or impersonate rules. • Update each affected custom ClusterRole to retain only the specific elevated permission that is explicitly required. • Replace broad assignments with lower-privilege roles and reduce scope from cluster-wide to namespace-scoped where possible. • Do not assign these permissions to workload service accounts unless there is a documented and approved need.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: akspoliciesrbacfile-permissions
Referencia: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster