Minimize access to the service account token creation

CaoCấp 1Xem xét thủ côngeks

Mô tả

Access to service account token creation in EKS should be limited to tightly controlled administrative or platform identities. Service accounts are a core Kubernetes identity type in EKS, projected service account tokens are used by workloads to authenticate, and Pods that do not need Kubernetes API access can avoid unnecessary token exposure by disabling automatic token mounting. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Begin by confirming that service account token creation in EKS is limited to identities with an approved administrative or workload identity need. Review token issuance through native Kubernetes RBAC, not through access entries, because access entries govern IAM principal access to the Kubernetes API while service account tokens remain Kubernetes credentials used by workloads and service accounts. Also confirm that token use aligns with expected Kubernetes API access, IRSA, or EKS Pod Identity behavior rather than ad hoc credential minting.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Review all Role and ClusterRole definitions for access to the serviceaccounts/token subresource, and remove that permission from any user, group, CI/CD identity, or workload service account that does not have a documented operational requirement. In EKS, service account token issuance remains a Kubernetes RBAC concern, while IAM principal access to the Kubernetes API is managed separately through access entries and associated access policies. Token-creation rights should remain limited to tightly controlled administrative or platform identities, because projected service account tokens are usable Kubernetes credentials and can also participate in workload identity flows such as IRSA.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ekspoliciesrbac
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.12 Minimize access to the service account token creation