Minimize access to the service account token creation

ВысокийУровень 1Ручная проверкаeks

Описание

Access to service account token creation in EKS should be limited to tightly controlled administrative or platform identities. Service accounts are a core Kubernetes identity type in EKS, projected service account tokens are used by workloads to authenticate, and Pods that do not need Kubernetes API access can avoid unnecessary token exposure by disabling automatic token mounting. The benchmark marks this recommendation Manual.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Begin by confirming that service account token creation in EKS is limited to identities with an approved administrative or workload identity need. Review token issuance through native Kubernetes RBAC, not through access entries, because access entries govern IAM principal access to the Kubernetes API while service account tokens remain Kubernetes credentials used by workloads and service accounts. Also confirm that token use aligns with expected Kubernetes API access, IRSA, or EKS Pod Identity behavior rather than ad hoc credential minting.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Review all Role and ClusterRole definitions for access to the serviceaccounts/token subresource, and remove that permission from any user, group, CI/CD identity, or workload service account that does not have a documented operational requirement. In EKS, service account token issuance remains a Kubernetes RBAC concern, while IAM principal access to the Kubernetes API is managed separately through access entries and associated access policies. Token-creation rights should remain limited to tightly controlled administrative or platform identities, because projected service account tokens are usable Kubernetes credentials and can also participate in workload identity flows such as IRSA.

Свойства

Операционные системы: Любая
Теги: ekspoliciesrbac
Источник: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.12 Minimize access to the service account token creation