Ensure pod/attach create roles are minimized in Kubernetes cluster in Kubernetes Role

HIGH

Description

Configuring a Kubernetes role other than for cluster-admin service which allows to create pod/attach can give an attacker to view logs of pods in real time.

Remediation

Make sure Kubernetes roles which allow to create pod/attach are allowed to cluster-admin service account. To make this change make sure to remove all the RoleBindings or ClusterRoleBindings that are overly permissive.

Policy Details

Rule Reference ID: AC_K8S_0107
Remediation Available: No
Resource: kubernetes_role
Resource Category: Management
Resource Type: Role

Frameworks