Minimize access to webhook configuration objects

高レベル 1手動レビューeks

説明

Access to ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects in EKS should be limited to tightly controlled cluster-administrative identities. These objects define admission webhooks that intercept Kubernetes API requests before they are accepted, and they apply at cluster scope rather than namespace scope. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Audit this control by identifying who can manage cluster-scoped ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources, and confirm that webhook definitions are limited to approved admission use cases in EKS. Review whether cluster access is managed through access entries and associated access policies or through Kubernetes groups and native RBAC, because EKS access entries are the primary cluster access model and Kubernetes-group authorization still depends on manually managed Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and rebind that access only to tightly controlled cluster-administrative identities. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve native Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep webhook-configuration management limited to a small set of approved administrative identities, because these objects sit directly in the admission path and operate at cluster scope. • Remove create, update, patch, and delete permissions on validatingwebhookconfigurations and mutatingwebhookconfigurations from broad custom ClusterRole and Role assignments.

プロパティ

オペレーティングシステム: すべて
タグ: ekspoliciesrbac
参照: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.11 Minimize access to webhook configuration objects