Amazon EKS
TMA-EKS-4.1.9
Minimize access to create persistent volumes
Mô tả
Permission to create persistent storage in EKS should be granted only where it is required. In EKS, this includes direct creation of PersistentVolume objects and, more commonly, the ability to trigger dynamic provisioning through PersistentVolumeClaim and StorageClass use, because EKS storage integrations such as the Amazon EBS CSI driver and EKS Auto Mode can automatically provision backing storage when applications request it. The benchmark marks this recommendation Manual.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Review EKS RBAC to identify any users, groups, or service accounts that can create PersistentVolume, PersistentVolumeClaim, or StorageClass resources. In EKS, this review should give particular attention to PersistentVolumeClaim and StorageClass permissions because persistent storage is commonly provisioned dynamically through CSI drivers and EKS storage integrations rather than by manually creating PersistentVolume objects.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Remove persistent-storage creation rights from any user, group, or service account that does not require them, and replace broad assignments with the lowest-privilege role and narrowest scope possible. In EKS, prioritize PersistentVolumeClaim and StorageClass permissions because persistent storage is commonly provisioned dynamically through CSI drivers rather than by manually creating PersistentVolume objects. Limit direct PersistentVolume and StorageClass administration to approved administrators, and allow workloads to use only the PersistentVolumeClaim access required for approved storage classes. After changes are made, verify that required applications can still provision storage through the intended CSI driver path.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- ekspoliciesrbac
- Tham chiếu
- CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.1.9 Minimize access to create persistent volumes