Minimize access to webhook configuration objects

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Audit this control by identifying who can modify cluster-scoped webhook configuration resources and confirming that webhook definitions are limited to approved admission use cases in AKS. The review should verify that ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects are present only where operationally required, that their scope is not broader than necessary, and that access to manage them is restricted through least-privilege RBAC.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate this control by removing permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and then rebinding that access only to tightly controlled cluster-administrative identities. In AKS, this should be implemented through least-privilege Kubernetes RBAC and, where used, Azure RBAC for Kubernetes Authorization, with access granted through centrally managed identity groups rather than widely distributed individual assignments. Service-account permissions should be reviewed as part of the same effort so workload identities do not inherit cluster-scoped webhook-management capability. Review each webhook configuration and narrow its match criteria to only the required namespaces, resources, and operations.