Ensure that Service Account Tokens are only mounted where necessary

높음레벨 1자동eks

설명

Service account tokens in EKS should be mounted only for Pods that require Kubernetes API access or an explicitly configured workload identity flow. EKS supports disabling automatic token mounting at the Pod or ServiceAccount level, and workloads that need AWS access through IRSA or EKS Pod Identity should use a dedicated service account rather than relying on broad default token mounting. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports pods with an auto-mounted service account token (kube-api-access-* volume).

점검 방법

감사 방식: 셸 명령

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}}{{range .spec.volumes}} {{.name}}{{end}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($0 ~ / kube-api-access-/)')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Apply the following steps to reduce unnecessary service account token mounting in EKS: • Set automountServiceAccountToken to false for Pods and ServiceAccounts that do not require Kubernetes API access. This reduces unnecessary default token auto-mounting. • Update workloads to use a dedicated serviceAccountName only where a service account token is operationally required, instead of inheriting token behavior from the namespace default service account. Each application should use its own dedicated service account. • For workloads that need AWS access, use IRSA or EKS Pod Identity with a dedicated service account rather than broad default token mounting. Both models associate AWS permissions to a Kubernetes service account for a specific workload boundary.

속성

운영 체제: 모두
태그: ekspoliciesrbac
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.6 Ensure that Service Account Tokens are only mounted where necessary

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target eks