Minimize access to the proxy sub-resource of nodes

VisokaNivo 1Ručni pregledeks

Opis

Access to the nodes/proxy subresource in EKS should be limited to identities with a documented node-administration or troubleshooting need. This review should cover custom Role and ClusterRole rules, RoleBinding and ClusterRoleBinding assignments, and any service accounts that receive node subresource access. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Review EKS RBAC to identify custom Role and ClusterRole objects that grant access to the nodes/proxy subresource, and validate that each permission is required for an approved troubleshooting, maintenance, or platform-administration function. Focus this review on customer-managed RBAC because EKS creates its own default RBAC identities for cluster components, while customer-defined node-proxy access is usually introduced through native Kubernetes RBAC.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Reduce custom RBAC access to the nodes/proxy API path so it is limited to approved administrative identities that require node-level access. In EKS, use access entries and associated access policies for standard cluster access wherever possible, and reserve custom Kubernetes RBAC for cases where the predefined access policies do not meet the requirement. Keep nodes/proxy limited to tightly controlled troubleshooting, maintenance, or platform-administration use cases, and avoid assigning it to workload service accounts. • Remove nodes/proxy from any custom Role or ClusterRole where node-level proxying is not explicitly required. • Where some node-related access is still needed, replace nodes/proxy with narrower permissions on only the specific resources and verbs required, and reduce scope from ClusterRole to namespace-scoped Role where the function allows it.

Svojstva

Operativni sistemi: Bilo koji
Oznake: ekspoliciesrbac
Referenca: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.10 Minimize access to the proxy sub-resource of nodes