Minimize access to webhook configuration objects

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Audit this control by identifying who can modify cluster-scoped webhook configuration resources and confirming that webhook definitions are limited to approved admission use cases in AKS. The review should verify that ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects are present only where operationally required, that their scope is not broader than necessary, and that access to manage them is restricted through least-privilege RBAC.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remediate this control by removing permission to create, update, patch, or delete ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects from broad ClusterRole and Role assignments, and then rebinding that access only to tightly controlled cluster-administrative identities. In AKS, this should be implemented through least-privilege Kubernetes RBAC and, where used, Azure RBAC for Kubernetes Authorization, with access granted through centrally managed identity groups rather than widely distributed individual assignments. Service-account permissions should be reviewed as part of the same effort so workload identities do not inherit cluster-scoped webhook-management capability. Review each webhook configuration and narrow its match criteria to only the required namespaces, resources, and operations.