Skip to main content

lacework-global-336

4.1.6 Ensure that Service Account Tokens are only mounted where necessary (Automated)​

note

This rule has been changed to automated, see Automated Rules for CIS Amazon EKS 1.1.0 for details.

Profile Applicability​

• Level 1

Description​

Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server

Rationale​

Mounting service account tokens inside pods can provide an avenue for privilege escalation attacks where an attacker is able to compromise a single pod in the cluster.

Avoiding mounting these tokens removes this attack avenue.

Impact​

Pods mounted without service account tokens will not be able to communicate with the API server, except where the resource is available to unauthenticated principals.

Audit​

Review pod and service account objects in the cluster and ensure that the option below is set, unless the resource explicitly requires this access.

automountServiceAccountToken: false

Remediation​

Modify the definition of pods and service accounts which do not need to mount service account tokens to disable it.

References​

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/