Ensure access to Secrets is minimized and granted only where required

高レベル 1手動レビューaks

説明

Verify that access to Kubernetes Secret objects in AKS are granted to only identities with a defined purpose. The review should include Azure RBAC for Kubernetes Authorization assignments, Kubernetes RBAC roles and bindings, and service account permissions, with particular attention to permissions that allow get, list, or watch access to secrets, because those permissions expose sensitive namespace-scoped data. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review the users who have get, list or watch access to secrets objects in the Kubernetes API.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Where possible, remove get, list and watch access to secret objects in the cluster.

プロパティ

オペレーティングシステム: すべて
タグ: akspoliciesrbacsecrets
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.2 Ensure access to Secrets is minimized and granted only where required