Ensure access to Secrets is minimized and granted only where required

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Start by reviewing every path that can grant access to Kubernetes Secret objects in the EKS cluster. Start with EKS access entries and associated access policies, because EKS policies can grant Kubernetes permissions without native RBAC objects, and AmazonEKSAdminViewPolicy includes permission to view Kubernetes Secrets. Then review Kubernetes RBAC, service account permissions, and any remaining legacy aws-auth mappings, because EKS can authorize access through multiple overlapping models and policy scope can be either cluster-wide or namespace-scoped.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Start by reducing every access path that allows reading Kubernetes Secret objects in the EKS cluster. Start with EKS access entries and associated access policies, because EKS policies can grant Secrets access without native RBAC objects, and policies such as AmazonEKSAdminViewPolicy, AmazonEKSSecretReaderPolicy, and broader administrative policies can expose Secrets depending on scope. Then reduce unnecessary access in Kubernetes RBAC, service accounts, and any remaining legacy aws-auth mappings, and replace broad permissions with the narrowest namespace or workload scope that still supports the required function. • Remove or narrow EKS access policy associations that expose Secrets, and prefer namespace-scoped access over cluster-wide scope wherever possible.