Minimize access to webhook configuration objects

高レベル 1手動レビューaks

説明

Minimize access to webhook configuration objects so that only tightly controlled cluster-administrative identities can create, update, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources in AKS. Admission controllers run after authentication and authorization but before an object is persisted, and Microsoft’s AKS documentation shows that webhook configurations define the webhook service endpoint and related trust ... The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Audit this control by identifying who can modify cluster-scoped webhook configuration resources and confirming that webhook definitions are limited to approved admission use cases in AKS. The review should verify that ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects are present only where operationally required, that their scope is not broader than necessary, and that access to manage them is restricted through least-privilege RBAC.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate this control by removing permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and then rebinding that access only to tightly controlled cluster-administrative identities. In AKS, this should be implemented through least-privilege Kubernetes RBAC and, where used, Azure RBAC for Kubernetes Authorization, with access granted through centrally managed identity groups rather than widely distributed individual assignments. Service-account permissions should be reviewed as part of the same effort so workload identities do not inherit cluster-scoped webhook-management capability. Review each webhook configuration and narrow its match criteria to only the required namespaces, resources, and operations.

プロパティ

オペレーティングシステム: すべて
タグ: akspoliciesrbac
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects