Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster

高レベル 1手動レビューaks

説明

Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators Review AKS authorization assignments to ensure bind, escalate, and impersonation permissions are granted only to identities with a documented administrative need. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review AKS RBAC to identify any users, groups, or service accounts granted bind, escalate, or impersonation permissions through Kubernetes RBAC or Azure RBAC for Kubernetes Authorization. • Identify roles and bindings that include bind, escalate, or impersonation permissions. • Determine which users, groups, or service accounts receive those permissions. • Validate that each assignment is required for a defined administrative function. • Flag any cluster-scoped or service-account assignment that lacks a documented need.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove bind, escalate, and impersonation permissions from any custom Role or ClusterRole that does not require them for an approved administrative function. Where these permissions are required, keep them limited to the smallest practical scope and avoid assigning them to workload service accounts, since AKS recommends minimum required permissions and service accounts continue to rely on Kubernetes RBAC. • Update each affected custom Role to remove unnecessary bind, escalate, or impersonate rules. • Update each affected custom ClusterRole to retain only the specific elevated permission that is explicitly required. • Replace broad assignments with lower-privilege roles and reduce scope from cluster-wide to namespace-scoped where possible. • Do not assign these permissions to workload service accounts unless there is a documented and approved need.

プロパティ

オペレーティングシステム: すべて
タグ: akspoliciesrbacfile-permissions
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster