Restrict ECR access for EKS runtime identities to pull-only permissions

MoyenneNiveau 1Revue manuelleeks

Description

Restricting ECR access for EKS runtime identities to pull-only permissions helps ensure that the identities used to run workloads can retrieve required container images without also receiving broader registry visibility or administrative access. In EKS, this applies to worker node IAM roles and, for Fargate workloads, the pod execution role that pulls images from private ECR repositories. The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Review the IAM role permissions and any ECR repository policies that apply to the runtime identities used by EKS to pull images, and verify that those identities are limited to pull-only access. Focus on the worker node IAM role for node-based workloads and the pod execution role for Fargate workloads.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Enforce pull-only ECR access for EKS runtime identities by limiting the worker node IAM role, and where applicable the Fargate pod execution role, to only the permissions required to authenticate to ECR and retrieve container image layers. The runtime pull path only needs ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Broader policies such as AmazonEC2ContainerRegistryReadOnly or AmazonEC2ContainerRegistryFullAccess expose additional repository visibility or administration capabilities that are not required just to start workloads. • Identify the runtime roles in scope. Review the node IAM role for node-based workloads and the pod execution role for Fargate workloads, because those are the identities used to pull private ECR images. • Remove broader ECR managed policies from runtime roles.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: eksmanaged-servicesregistryfile-permissions
Référence: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.1.3 Restrict ECR access for EKS runtime identities to pull-only permissions