Enforce least privilege for ECR repositories storing EKS Auto Mode workload images

높음레벨 1수동 검토eks-auto

설명

Least privilege access for Amazon ECR repositories helps limit who can pull, push, delete, or administer container images used by EKS Auto Mode workloads. This reduces unnecessary exposure of the image registry and helps ensure that only the identities required to support image pulls, image publishing, release promotion, and repository administration can access the repositories. EKS Auto Mode shifts more infrastructure management to AWS. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the IAM permissions and ECR repository policies that apply to repositories used by EKS Auto Mode workload images, and verify that access is limited to approved EKS Auto Mode Node IAM roles, CI/CD identities, cross-account principals, and repository administration roles. Confirm that runtime pull access is limited to the minimum ECR actions required for image retrieval, that push or administrative access is limited to the repositories and actions required, and that no unnecessary wildcard or broad cross-account access is present.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enforce least privilege access for ECR repositories used by EKS Auto Mode workload images by separating image pull, image push, account access, and repository administration into different IAM roles and policy scopes. Grant the EKS Auto Mode Node IAM role only the ECR permissions needed to authenticate and pull images, such as ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Scope CI/CD and administrator access to the specific repositories and actions they require, and review both IAM identity based policies and ECR repository policies because ECR authorization can be affected by both. Separate ECR access by role. Use different roles for EKS Auto Mode runtime image pulls, CI/CD image pushes, account repository access, and repository administration. • Replace broad pull access with pull-only permissions where possible.

속성

운영 체제: 모두
태그: eks-automanaged-servicesregistry
참고 자료: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 5.1.2 Enforce least privilege for ECR repositories storing EKS Auto Mode workload images