Amazon EKS
TMA-EKS-4.1.11
Minimize access to webhook configuration objects
Deskripsi
Access to ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects in EKS should be limited to tightly controlled cluster-administrative identities. These objects define admission webhooks that intercept Kubernetes API requests before they are accepted, and they apply at cluster scope rather than namespace scope. The benchmark marks this recommendation Manual.
Cara pemeriksaan
Metode audit: Tinjauan manual
Audit this control by identifying who can manage cluster-scoped ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources, and confirm that webhook definitions are limited to approved admission use cases in EKS. Review whether cluster access is managed through access entries and associated access policies or through Kubernetes groups and native RBAC, because EKS access entries are the primary cluster access model and Kubernetes-group authorization still depends on manually managed Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Remove permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and rebind that access only to tightly controlled cluster-administrative identities. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve native Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep webhook-configuration management limited to a small set of approved administrative identities, because these objects sit directly in the admission path and operate at cluster scope. • Remove create, update, patch, and delete permissions on validatingwebhookconfigurations and mutatingwebhookconfigurations from broad custom ClusterRole and Role assignments.
Properti
- Sistem operasi
- Apa saja
- Tag
- ekspoliciesrbac
- Referensi
- CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects