TMA-AKS-4.1.2
Ensure access to Secrets is minimized and granted only where required
高级别 1人工审核aks
说明
Verify that access to Kubernetes Secret objects in AKS are granted to only identities with a defined purpose. The review should include Azure RBAC for Kubernetes Authorization assignments, Kubernetes RBAC roles and bindings, and service account permissions, with particular attention to permissions that allow get, list, or watch access to secrets, because those permissions expose sensitive namespace-scoped data. The benchmark marks this recommendation Manual.
检查方式
审计方法: 人工审核
此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。
Review the users who have get, list or watch access to secrets objects in the Kubernetes API.
修复方式
修复方法: 操作指南或基础设施补丁
Where possible, remove get, list and watch access to secret objects in the cluster.
属性
- 操作系统
- 任意
- 标签
- akspoliciesrbacsecrets
- 参考
- CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.1.2 Ensure access to Secrets is minimized and granted only where required