Minimize access to create pods

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Begin by reviewing every path that can grant the ability to create Pods in EKS Auto Mode. Start with access entries and associated access policies, because Auto Mode uses the EKS API access-entry model, and AmazonEKSAdminPolicy and AmazonEKSEditPolicy include create access for pods. Then review Kubernetes RBAC, service accounts, and Pod security controls, because Pod creation can allow an identity to launch workloads under available service accounts and potentially exercise both Kubernetes and AWS permissions.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Begin with access entries and associated access policies, because AmazonEKSAdminPolicy and AmazonEKSEditPolicy include create access for pods, and access policies can be to the cluster or to specific namespaces. Then reduce unnecessary permissions in Kubernetes RBAC, service accounts, and Pod security controls so Pod creation is limited to approved deployment paths and the smallest practical workload boundary. • Remove or narrow access policy associations that allow Pod creation, and prefer namespace access over cluster scope wherever possible. If predefined access policies are still broader than required, use access entries with Kubernetes group assignments and custom RBAC to grant the exact permissions needed. • Replace broad RBAC permissions on pods, deployments, daemonsets, statefulsets, jobs, and cronjobs with the smallest Role or ClusterRole that supports the approved function.