Detections
Analytics

4.1.2 Minimize access to secrets

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Where possible, remove get, list or watch access to secret objects in the cluster.

Impact:

Care should be taken not to remove access to secrets to system components which require this for their operation

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.2

Plugin: GCP

Control ID: 58bfa404c92d8b1e69ffc5bd8f8f25e8d626c86c7f17b9eaeea7902b97287fe3