Minimize wildcard use in Roles and ClusterRoles

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Begin by reviewing custom Kubernetes Role and ClusterRole objects in EKS Auto Mode to identify any use of wildcard entries such as * for verbs, resources, or apiGroups. In EKS, this review should cover native RBAC objects, access entries that reference Kubernetes groups, service accounts, and any remaining aws-auth mappings only where ConfigMap based access still applies, because EKS supports access through both access entries and Kubernetes RBAC, and it also creates its own platform RBAC objects that should be distinguished from customer defined permissions.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Begin by replacing wildcard permissions in custom Role and ClusterRole objects with explicitly enumerated verbs, resources, and apiGroups that match the approved operational need. In EKS, this remediation should focus on customer managed RBAC objects, the bindings that assign them, access entries that reference Kubernetes groups, and service accounts used by workloads or cluster components. EKS guidance favors specific access through access entries and using custom RBAC only when predefined access policies do not meet the requirement, especially for service accounts used by add-ons, DaemonSets, and CSI drivers. • Replace wildcard values in custom Role and ClusterRole rules with the specific verbs, resources, and apiGroups the function actually requires.