Mount secrets as files instead of environment variables

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review workload manifests and identify any Pod, Deployment, DaemonSet, StatefulSet, Job, or CronJob that exposes secrets through environment variables instead of mounted files. Check for both direct secret references through env[].valueFrom.secretKeyRef and bulk secret imports through envFrom[].secretRef, because either pattern exposes secret data as environment variables. Prefer workloads that consume secrets through mounted Secret volumes or file delivery from AWS secrets integrations instead.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Update workloads to consume secrets as mounted files instead of environment variables. Replace env[].valueFrom.secretKeyRef and envFrom[].secretRef usage with Kubernetes Secret volumes or the AWS Secrets and Configuration Provider with the Secrets Store CSI Driver, and then update the application to read the secret from the mounted file path. This reduces the chance of secret values appearing in logs and aligns with the recommended file delivery pattern for EKS workloads. For Kubernetes Secrets, mount the Secret as a volume and update the application configuration to read from the mounted path rather than from environment variables.