Minimize access to webhook configuration objects

ÉlevéeNiveau 1Revue manuelleeks

Description

Access to ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects in EKS should be limited to tightly controlled cluster-administrative identities. These objects define admission webhooks that intercept Kubernetes API requests before they are accepted, and they apply at cluster scope rather than namespace scope. The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Audit this control by identifying who can manage cluster-scoped ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources, and confirm that webhook definitions are limited to approved admission use cases in EKS. Review whether cluster access is managed through access entries and associated access policies or through Kubernetes groups and native RBAC, because EKS access entries are the primary cluster access model and Kubernetes-group authorization still depends on manually managed Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Remove permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and rebind that access only to tightly controlled cluster-administrative identities. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve native Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep webhook-configuration management limited to a small set of approved administrative identities, because these objects sit directly in the admission path and operate at cluster scope. • Remove create, update, patch, and delete permissions on validatingwebhookconfigurations and mutatingwebhookconfigurations from broad custom ClusterRole and Role assignments.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: ekspoliciesrbac
Référence: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects