Minimize access to the proxy sub-resource of nodes

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review EKS RBAC to identify custom Role and ClusterRole objects that grant access to the nodes/proxy subresource, and validate that each permission is required for an approved troubleshooting, maintenance, or platform-administration function. Focus this review on customer-managed RBAC because EKS creates its own default RBAC identities for cluster components, while customer-defined node-proxy access is usually introduced through native Kubernetes RBAC.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Reduce custom RBAC access to the nodes/proxy API path so it is limited to approved administrative identities that require node-level access. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve custom Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep nodes/proxy limited to tightly controlled troubleshooting, maintenance, or platform-administration use cases, and avoid assigning it to workload service accounts. • Remove nodes/proxy from any custom Role or ClusterRole where node-level proxying is not explicitly required. • Where some node-related access is still needed, replace nodes/proxy with narrower permissions on only the specific resources and verbs required, and reduce scope from ClusterRole to namespace-scoped Role where the function allows it.