Roles and cluster roles should not grant 'get', 'list', or 'watch' permissions for secrets Affecting Service service in Kubernetes
CCSS (Common Configuration Scoring System) is a set of measures used to determine the severity of the rule.
Each rule is associated with a high-level category. For example IAM, Container, Monitoring, Logging, Network, etc.
Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CC-00651
- creditSnyk Research Team
Description
Roles and cluster roles should not grant 'get', 'list', or 'watch' permissions for secrets. RBAC resources in Kubernetes are used to grant access to get, list, and watch secrets on the Kubernetes API. Restrict use of these permissions to the smallest set of users and service accounts as possible.
How to fix?
Set the verbs attribute in Role and ClusterRole to a value other than "get", "list", or "watch" where resources is set to secrets.
Example configuration:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: secret-access-role
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "update", "delete", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: secret-access-cluster-role
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "update", "delete", "patch"]
Set the verbs attribute in kubernetes_role and kubernetes_cluster_role to a value other than "get", "list", or "watch" where resources is set to secrets.
Example configuration:
resource "kubernetes_role" "allowed1" {
metadata {
name = "secret-access-role"
}
rule {
api_groups = [""]
resources = ["secrets"]
verbs = ["create", "update", "delete", "patch"]
}
}
resource "kubernetes_cluster_role" "allowed2" {
metadata {
name = "secret-access-cluster-role"
}
rule {
api_groups = [""]
resources = ["secrets"]
verbs = ["create", "update", "delete", "patch"]
}
}