Standardize EKS cluster access by using access entries, policies, and permissions

YüksekDüzey 1Otomatikeks-auto

Açıklama

EKS Auto Mode provides the Cluster Access Management API, access entries, and associated access policies as the recommended way to manage IAM principal access to the Kubernetes API. This model is preferred over the deprecated aws-auth ConfigMap for cluster access management, supports cluster or namespace permissions, and can also reference Kubernetes groups when native Role, ClusterRole, RoleBinding, or ClusterRoleBinding objects are needed for ... Requires the aws CLI with eks:DescribeCluster; the cluster comes from EKS_CLUSTER and the region from AWS_REGION/AWS_PROFILE. Checks the authentication mode is API or API_AND_CONFIG_MAP; review access entry scopes separately.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

m=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query cluster.accessConfig.authenticationMode --output text) || exit 1
case "$m" in API|API_AND_CONFIG_MAP) echo compliant;; *) echo "noncompliant: authenticationMode=$m";; esac

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Log in to the AWS Management Console, navigate Amazon Elastic Kubernetes Service > Clusters and click on your EKS cluster. Go to the Access tab and click on Manage in the Access Configuration section. Under Cluster Authentication Mode for Cluster Access settings choose one of the following. • EKS API Use this as the target mode for EKS Auto Mode clusters after access has been migrated to access entries and associated access policies. The cluster will source authenticated IAM principals only from EKS access entry APIs • EKS API and ConfigMap Use this only when legacy aws-auth ConfigMap access must still coexist during migration or for an approved compatibility need.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: eks-autopoliciesrbacfile-permissions
Referans: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 4.1.7 Standardize EKS cluster access by using access entries, policies, and permissions

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target eks-auto