Ensure that the cluster-admin role is only used where required

심각레벨 1수동 검토eks

설명

Verify that cluster-wide administrative access in Amazon EKS is granted only to identities with a documented need for full cluster administration. In EKS, this review should cover access entries associated with AmazonEKSClusterAdminPolicy, legacy aws-auth and Kubernetes group mappings that lead to ClusterRoleBinding assignments, and any service accounts bound to cluster-wide administrative permissions. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

This audit reviews Kubernetes ClusterRoleBinding objects in the Amazon EKS cluster to identify principals that are directly granted the cluster-admin ClusterRole. It lists each matching binding and its associated users, groups, or service accounts so the reviewer can verify whether full cluster-wide administrative access is justified.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Review each ClusterRoleBinding identified by the audit that grants the Kubernetes cluster-admin ClusterRole, and determine whether the listed user, group, or service account still requires full cluster-wide administrative access. In Amazon EKS, this review should also account for access granted through EKS access entries and access policies, because AWS recommends access entries as the preferred way to grant Kubernetes API access. Where responsibilities are limited to a namespace, workload, or operational function, replace cluster-wide administration with a narrower authorization model. • Review each principal returned by the audit and confirm whether full cluster-wide administrative access is still justified for that identity.

속성

운영 체제: 모두
태그: ekspoliciesrbac
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.1 Ensure that the cluster-admin role is only used where required