Ensure access to Secrets is minimized and granted only where required

높음레벨 1수동 검토aks

설명

Verify that access to Kubernetes Secret objects in AKS are granted to only identities with a defined purpose. The review should include Azure RBAC for Kubernetes Authorization assignments, Kubernetes RBAC roles and bindings, and service account permissions, with particular attention to permissions that allow get, list, or watch access to secrets, because those permissions expose sensitive namespace-scoped data. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the users who have get, list or watch access to secrets objects in the Kubernetes API.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Where possible, remove get, list and watch access to secret objects in the cluster.

속성

운영 체제: 모두
태그: akspoliciesrbacsecrets
참고 자료: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.2 Ensure access to Secrets is minimized and granted only where required