Ensure that default service accounts are not actively used.

CaoCấp 1Tự độngeks

Mô tả

Default service accounts in EKS should not be used as the active identity for ordinary application or automation workloads. If a Pod does not specify a service account, Kubernetes automatically assigns the namespace default service account, and that account can authenticate to the Kubernetes API through its mounted token. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. Fails when a default service account does not set automountServiceAccountToken: false or is bound to a Role/ClusterRole.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

sa=$(kubectl get serviceaccounts -A -o go-template='{{range .items}}{{if eq .metadata.name "default"}}{{.metadata.namespace}} {{.automountServiceAccountToken}}{{"\n"}}{{end}}{{end}}') || exit 1
rb=$(kubectl get rolebindings,clusterrolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{$bn:=.metadata.namespace}}{{range .subjects}}{{if eq .kind "ServiceAccount"}}{{if eq .name "default"}}{{if .namespace}}{{.namespace}}{{else}}{{$bn}}{{end}} {{$b}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$sa" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && $2!="false" {print "automount: " $1}')
bad2=$(printf '%s\n' "$rb" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex {print "binding: " $0}')
if [ -z "$bad$bad2" ]; then echo compliant; else printf '%s\n%s\n' "$bad" "$bad2" | grep . | head -n 25; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Create dedicated service accounts for workloads that need Kubernetes API access, IRSA, or EKS Pod Identity, and update those workloads to explicitly set serviceAccountNam rather than relying on the namespace default service account. For workloads that do not need Kubernetes API access, disable service account token auto-mounting and avoid using the default service account as the active workload identity. Also review the default service account in each namespace and ensure it is not bound to unnecessary RBAC permissions.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ekspoliciesrbac
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.5 Ensure that default service accounts are not actively used.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target eks