Ensure that Service Account Tokens are only mounted where necessary

Cara pemeriksaan

Metode audit: Perintah shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}}{{range .spec.volumes}} {{.name}}{{end}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($0 ~ / kube-api-access-/)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Apply the following steps to reduce unnecessary service account token mounting in EKS: • Set automountServiceAccountToken to false for Pods and ServiceAccounts that do not require Kubernetes API access. This reduces unnecessary default token auto-mounting. • Update workloads to use a dedicated serviceAccountName only where a service account token is operationally required, instead of inheriting token behavior from the namespace default service account. Each application should use its own dedicated service account. • For workloads that need AWS access, use IRSA or EKS Pod Identity with a dedicated service account rather than broad default token mounting. Both models associate AWS permissions to a Kubernetes service account for a specific workload boundary.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target eks