Amazon EKS
TMA-EKS-4.1.4
Minimize access to create pods
Mô tả
The ability to create Pods in EKS is a high-risk permission that should be limited to approved deployment and operational functions. In EKS, Pod creation can be granted through associated access policies or native Kubernetes RBAC, and policies such as AmazonEKSAdminPolicy and AmazonEKSEditPolicy include create access on pods. The benchmark marks this recommendation Manual.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Begin by reviewing every path that can grant the ability to create Pods in EKS. Start with access entries and associated access policies, because AmazonEKSAdminPolicy and AmazonEKSEditPolicy include create access for pods. Then review Kubernetes RBAC, service accounts, and Pod security controls, because Pod creation can allow an identity to launch workloads under available service accounts and potentially exercise both Kubernetes and AWS permissions.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Start by reducing every access path that allows Pod creation in EKS. Start with access entries and associated access policies, because AmazonEKSAdminPolicy and AmazonEKSEditPolicy include create access for pods, and access policies can be scoped to the cluster or to specific namespaces. Then reduce unnecessary permissions in Kubernetes RBAC, service accounts, and Pod security controls so Pod creation is limited to approved deployment paths and the smallest practical workload boundary. • Remove or narrow access policy associations that allow Pod creation, and prefer namespace-scoped access over cluster-wide scope wherever possible. • Replace broad RBAC permissions on pods, deployments, daemonsets, statefulsets, jobs, and cronjobs with the smallest Role or ClusterRole that supports the approved function.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- ekspoliciesrbac
- Tham chiếu
- CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.4 Minimize access to create pods