Prefer using dedicated EKS Service Accounts

높음레벨 1자동eks

설명

Using dedicated Kubernetes service accounts for EKS workloads helps isolate AWS permissions by application, job, or trust boundary instead of sharing a single identity across multiple workloads. This supports more controlled access to AWS services and reduces the blast radius if one workload is compromised or misconfigured. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Reports pods running as the namespace default service account.

점검 방법

감사 방식: 셸 명령

shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.serviceAccountName}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="default" || $3=="<no")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Use dedicated Kubernetes service accounts for EKS workloads and associate AWS permissions to those service accounts instead of relying on the namespace default service account or broad worker node IAM permissions. Prefer EKS Pod Identity where supported, and use IRSA where Pod Identity is not supported or where IRSA is specifically required. Create one dedicated service account and one least-privilege IAM role for each application or distinct permission boundary, and update workload manifests to reference the intended service account explicitly. Disable automatic service account token mounting for workloads that do not need Kubernetes API access. After migrating workloads to dedicated service accounts, restrict access to the worker node instance profile so pods cannot inherit broader node credentials.

속성

운영 체제: 모두
태그: eksmanaged-servicesrbac
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.2.1 Prefer using dedicated EKS Service Accounts

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target eks