Ensure impersonate access to Kubernetes resources is minimized in Kubernetes Role

HIGH

Description

Configuring a role with verb impersonate for resources group/user/* can let attacker impersonate legitimate resources.

Remediation

Make sure use of verb impersonate for any Kubernetes resource is prohibited unless required. To make this change make sure to remove all the RoleBindings or ClusterRoleBindings that are overly permissive.

Policy Details

Rule Reference ID: AC_K8S_0102
Remediation Available: No
Resource: kubernetes_role
Resource Category: Management
Resource Type: Role

Frameworks