TMA-AKS-4.1.2
Ensure access to Secrets is minimized and granted only where required
Deskripsi
Verify that access to Kubernetes Secret objects in AKS are granted to only identities with a defined purpose. The review should include Azure RBAC for Kubernetes Authorization assignments, Kubernetes RBAC roles and bindings, and service account permissions, with particular attention to permissions that allow get, list, or watch access to secrets, because those permissions expose sensitive namespace-scoped data. The benchmark marks this recommendation Manual.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Review the users who have get, list or watch access to secrets objects in the Kubernetes API.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Where possible, remove get, list and watch access to secret objects in the cluster.
Properti
- Sistem operasi
- Apa saja
- Tag
- akspoliciesrbacsecrets
- Referensi
- CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.2 Ensure access to Secrets is minimized and granted only where required