Project: KICS (Provisioning / Security & Compliance)
File: 056ac60e-fe07-4acc-9b34-8e1d51716ab9.md

title: ServiceAccount Allows Access Secrets hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 056ac60e-fe07-4acc-9b34-8e1d51716ab9 Query name: ServiceAccount Allows Access Secrets Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: Roles and ClusterRoles when binded, should not use get, list or watch as verbs<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10 34 58" kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleVulnerable rules: apiGroups: [""] resources: ["secrets"] verbs: ["get", "watch", "list"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: testRoleBinding namespace: bindingTestWithBinding subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: Role name: testRoleVulnerable apiGroup: rbac.authorization.k8s.io kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleVulnerable2 rules: apiGroups: [""] resources: ["secrets"] verbs: ["*"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: testRoleBinding namespace: bindingTestWithBinding2 subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: Role name: testRoleVulnerable2 apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: testClusterRoleVulnerable rules: apiGroups: [""] resources: ["secrets"] verbs: ["update", "list"] kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingTestClusterRoleWithBinding namespace: bindingTestClusterRoleWithBindingNamespace subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: ClusterRole name: testClusterRoleVulnerable apiGroup: rbac.authorization.k8s.io ``` ```yaml title="Negative test num. 1 - yaml file" kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleWithoutBindingVulnerable rules: apiGroups: [""] resources: ["secrets"] verbs: ["get", "watch", "list"] kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleWithBindingVulnerableNotSA rules: apiGroups: [""] resources: ["secrets"] verbs: ["get", "watch", "list"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingNotSATestRoleWithBindingVulnerable namespace: bindingNotSATestRoleWithBindingVulnerableNamespace subjects: kind: NotServiceAccount name: testsa apiGroup: "" roleRef: kind: Role name: testRoleWithBindingVulnerableNotSA apiGroup: rbac.authorization.k8s.io kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleWithBindingSafe rules: apiGroups: [""] resources: ["secrets"] verbs: ["update"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingtestRoleWithBindingSafe namespace: bindingtestRoleWithBindingSafeNamespace subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: Role name: testRoleWithBindingSafe apiGroup: rbac.authorization.k8s.io kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: assembly-prod name: testRoleVulnerablePod rules: apiGroups: [""] resources: ["pod"] verbs: ["get", "watch", "list"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: testRoleBinding namespace: bindingTestWithBindingPod subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: Role name: testRoleVulnerablePod apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: testClusterRoleWithoutBindingVulnerable rules: apiGroups: [""] resources: ["secrets"] verbs: ["get", "watch", "list"] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: namespace: default name: testClusterRoleWithBindingVulnerableNotSA rules: apiGroups: [""] # "" indicates the core API group resources: ["secrets"] verbs: ["get", "watch", "list"] kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingNotSATestClusterRoleWithBindingVulnerable namespace: bindingNotSATestClusterRoleWithBindingVulnerableNamespace subjects: kind: NotServiceAccount name: testsa apiGroup: "" roleRef: kind: ClusterRole name: testClusterRoleWithBindingVulnerableNotSA apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: namespace: default name: testClusterRoleWithBindingSafe rules: apiGroups: [""] # "" indicates the core API group resources: ["secrets"] verbs: ["update"] kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingTestClusterRoleWithBindingSafe namespace: bindingTestClusterRoleWithBindingSafeNamespace subjects: kind: NotServiceAccount name: testsa apiGroup: "" roleRef: kind: ClusterRole name: testClusterRoleWithBindingSafe apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: testClusterRoleVulnerablePod rules: apiGroups: [""] resources: ["pod"] verbs: ["update", "list"] kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: bindingTestClusterRoleWithBinding namespace: bindingTestClusterRoleWithBindingNamespace subjects: kind: ServiceAccount name: testsa apiGroup: "" roleRef: kind: ClusterRole name: testClusterRoleVulnerablePod apiGroup: rbac.authorization.k8s.io ```