Ensure use of creating Kubernetes rolebindings and attaching Kubernetes roles is minimized in Kubernetes Role

HIGH

Description

Configuring a role which allows to create a rolebinding/clusterrolebindings and further allows to bind role/clusterroles can give an attacker chance to attach privileged cluster roles to his/her choice of service account.

Remediation

Make sure Kubernetes creating rolebindings and attaching Kubernetes roles is allowed to cluster-admin service account. To make this change make sure to remove all the RoleBindings or ClusterRoleBindings that are overly permissive.

Policy Details

Rule Reference ID: AC_K8S_0105
Remediation Available: No
Resource: kubernetes_role
Resource Category: Management
Resource Type: Role

Frameworks