Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review AKS Automatic RBAC to identify any users, groups, or service accounts granted bind, escalate, or impersonate permissions through Kubernetes RBAC or Microsoft Entra ID authorization for the Kubernetes API. • Identify Roles and ClusterRoles that include bind, escalate, or impersonate, then trace the RoleBindings and ClusterRoleBindings that assign them. • Determine which users, groups, or service accounts receive those permissions. • Validate that each assignment is required for a defined administrative function.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove bind, escalate, and impersonate permissions from any custom Role, ClusterRole, or Azure custom role that does not require them for an approved administrative function. Where these permissions are required, keep them limited to the required resources and namespace and avoid assigning them to workload service accounts. • Update each affected custom Role to remove unnecessary bind, escalate, or impersonate rules. • Update each affected custom ClusterRole to retain only the specific elevated permission that is explicitly required. • Remove unnecessary corresponding DataActions from Azure custom roles used to authorize access to the Kubernetes API. • Replace broad assignments with roles that have fewer permissions, and limit access to the required namespace rather than the entire cluster where possible.