Minimize wildcard use in Roles and ClusterRoles

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Begin by reviewing custom Kubernetes Role and ClusterRole objects in EKS Auto Mode to identify any use of wildcard entries such as * for verbs, resources, or apiGroups. In EKS, this review should cover native RBAC objects, access entries that reference Kubernetes groups, service accounts, and any remaining aws-auth mappings only where ConfigMap based access still applies, because EKS supports access through both access entries and Kubernetes RBAC, and it also creates its own platform RBAC objects that should be distinguished from customer defined permissions.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Begin by replacing wildcard permissions in custom Role and ClusterRole objects with explicitly enumerated verbs, resources, and apiGroups that match the approved operational need. In EKS, this remediation should focus on customer managed RBAC objects, the bindings that assign them, access entries that reference Kubernetes groups, and service accounts used by workloads or cluster components. EKS guidance favors specific access through access entries and using custom RBAC only when predefined access policies do not meet the requirement, especially for service accounts used by add-ons, DaemonSets, and CSI drivers. • Replace wildcard values in custom Role and ClusterRole rules with the specific verbs, resources, and apiGroups the function actually requires.