Ensure access to Secrets is minimized and granted only where required

높음레벨 1수동 검토eks-auto

설명

Verify that access to Kubernetes Secret objects in EKS Auto Mode is granted only to IAM principals, Kubernetes users or groups, and workload identities with a defined operational or application need. The review should cover EKS access entries and associated access policies, Kubernetes RBAC roles and bindings, and workload access paths tied to Kubernetes service accounts and EKS Pod Identity. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review every path that can grant access to Kubernetes Secrets in an EKS Auto Mode cluster. Start with EKS access entries and associated access policies, because Auto Mode uses the EKS API access-entry model. Then review Kubernetes RBAC, service accounts, Pod Identity associations for workloads that access AWS secret stores, and legacy aws-auth mappings only if the cluster uses API_AND_CONFIG_MAP. Effective access can come from overlapping EKS access policies, Kubernetes groups, and RBAC bindings, and access policy scope can be either cluster or namespace.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Start with EKS access entries and associated access policies, because EKS policies can grant Secrets access without native RBAC objects, and policies such as AmazonEKSAdminViewPolicy, AmazonEKSSecretReaderPolicy, and broader administrative policies can expose Secrets depending on scope. Then reduce unnecessary access in Kubernetes RBAC, service accounts, and any remaining legacy aws-auth mappings, and replace broad permissions with the narrowest namespace or workload scope that still supports the required function. • Remove or narrow EKS access policy associations that expose Secrets, and prefer namespace access within the cluster wherever possible. If AWS managed access policies are still broader than required, use access entries with Kubernetes group assignments and custom Kubernetes RBAC to grant the exact permissions needed.

속성

운영 체제: 모두
태그: eks-autopoliciesrbacsecrets
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 4.1.2 Ensure access to Secrets is minimized and granted only where required