Prefer using dedicated EKS Service Accounts

Kako se proverava

Metod provere: Komanda ljuske

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.serviceAccountName}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="default" || $3=="<no")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Use dedicated Kubernetes service accounts for EKS workloads and associate AWS permissions to those service accounts instead of relying on the namespace default service account or broad worker node IAM permissions. Prefer EKS Pod Identity where supported, and use IRSA where Pod Identity is not supported or where IRSA is specifically required. Create one dedicated service account and one least-privilege IAM role for each application or distinct permission boundary, and update workload manifests to reference the intended service account explicitly. Disable automatic service account token mounting for workloads that do not need Kubernetes API access. After migrating workloads to dedicated service accounts, restrict access to the worker node instance profile so pods cannot inherit broader node credentials.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target eks