Ensure access to Secrets is minimized and granted only where required

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Start by reviewing every path that can grant access to Kubernetes Secret objects in the EKS cluster. Start with EKS access entries and associated access policies, because EKS policies can grant Kubernetes permissions without native RBAC objects, and AmazonEKSAdminViewPolicy includes permission to view Kubernetes Secrets. Then review Kubernetes RBAC, service account permissions, and any remaining legacy aws-auth mappings, because EKS can authorize access through multiple overlapping models and policy scope can be either cluster-wide or namespace-scoped.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Start by reducing every access path that allows reading Kubernetes Secret objects in the EKS cluster. Start with EKS access entries and associated access policies, because EKS policies can grant Secrets access without native RBAC objects, and policies such as AmazonEKSAdminViewPolicy, AmazonEKSSecretReaderPolicy, and broader administrative policies can expose Secrets depending on scope. Then reduce unnecessary access in Kubernetes RBAC, service accounts, and any remaining legacy aws-auth mappings, and replace broad permissions with the narrowest namespace or workload scope that still supports the required function. • Remove or narrow EKS access policy associations that expose Secrets, and prefer namespace-scoped access over cluster-wide scope wherever possible.