Minimize wildcard use in Roles and ClusterRoles

Trung bìnhCấp 1Xem xét thủ côngeks

Mô tả

Verify that Kubernetes Role and ClusterRole objects in EKS do not use wildcard entries such as * for verbs, resources, or apiGroups unless a documented administrative or platform requirement exists. The review should also include the RoleBinding and ClusterRoleBinding objects that assign those roles to users, groups, or service accounts, because EKS can authorize access through both access entries and native Kubernetes RBAC, and principals can ... The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Begin by reviewing custom Kubernetes Role and ClusterRole objects in EKS to identify any use of wildcard entries such as * for verbs, resources, or apiGroups. In EKS, this review should cover native RBAC objects, access entries that reference Kubernetes groups, service accounts, and any remaining aws-auth mappings, because EKS supports access through both access entries and Kubernetes RBAC, and it also creates its own platform RBAC objects that should be distinguished from customer-defined permissions.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Start by replacing wildcard permissions in custom Role and ClusterRole objects with explicitly enumerated verbs, resources, and apiGroups that match the approved operational need. In EKS, this remediation should focus on customer-managed RBAC objects, the bindings that assign them, access entries that reference Kubernetes groups, and service accounts used by workloads or cluster components. EKS guidance favors fine-grained access through access entries and least-privilege review of RBAC permissions, especially for service accounts used by add-ons, DaemonSets, and CSI drivers. • Replace wildcard values in custom Role and ClusterRole rules with the specific verbs, resources, and apiGroups the function actually requires.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ekspoliciesrbac
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.3 Minimize wildcard use in Roles and ClusterRoles