Project: KICS (Provisioning / Security & Compliance)
File: 07fc3413-e572-42f7-9877-5c8fc6fccfb5.md

title: Service Account Allows Access Secrets hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 07fc3413-e572-42f7-9877-5c8fc6fccfb5 Query name: Service Account Allows Access Secrets Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: Kubernetesrole and Kubernetescluster_role when binded, should not use get, list or watch as verbs<br> ```tf title="Positive test num. 1 - tf file" hl_lines="49 7" resource "kubernetesclusterrole" "clusterrolename" { metadata { name = "terraform-example-1" } rule { api_groups = [""] resources = ["namespaces", "pods", "secrets"] verbs = ["get", "list", "watch"] } } resource "kubernetesclusterrole_binding" "example" { metadata { name = "terraform-example-2" } role_ref { api_group = "rbac.authorization.k8s.io" kind = "ClusterRole" name = "clusterrolename" } subject { kind = "User" name = "admin" api_group = "rbac.authorization.k8s.io" } subject { kind = "ServiceAccount" name = "default" namespace = "kube-system" } subject { kind = "Group" name = "system:masters" api_group = "rbac.authorization.k8s.io" } } resource "kubernetesrole" "rolename" { metadata { name = "terraform-example" labels = { test = "MyRole" } } rule { api_groups = [""] resources = ["pods"] resource_names = ["foo"] verbs = ["get", "list", "watch"] } rule { api_groups = ["apps"] resources = ["deployments"] verbs = ["get", "list"] } rule { api_groups = [""] resources = ["secrets"] verbs = ["*"] } } resource "kubernetesrolebinding" "example" { metadata { name = "terraform-example" namespace = "default" } role_ref { api_group = "rbac.authorization.k8s.io" kind = "Role" name = "role_name" } subject { kind = "User" name = "admin" api_group = "rbac.authorization.k8s.io" } subject { kind = "ServiceAccount" name = "default" namespace = "kube-system" } subject { kind = "Group" name = "system:masters" api_group = "rbac.authorization.k8s.io" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetesclusterrole" "clusterrolename" { metadata { name = "terraform-example-1" } rule { api_groups = [""] resources = ["namespaces", "pods"] verbs = ["get", "list", "watch"] } } resource "kubernetesclusterrole_binding" "example" { metadata { name = "terraform-example-2" } role_ref { api_group = "rbac.authorization.k8s.io" kind = "ClusterRole" name = "clusterrolename" } subject { kind = "User" name = "admin" api_group = "rbac.authorization.k8s.io" } subject { kind = "ServiceAccount" name = "default" namespace = "kube-system" } subject { kind = "Group" name = "system:masters" api_group = "rbac.authorization.k8s.io" } } resource "kubernetesrole" "rolename" { metadata { name = "terraform-example" labels = { test = "MyRole" } } rule { api_groups = [""] resources = ["pods"] resource_names = ["foo"] verbs = ["get", "list", "watch"] } rule { api_groups = ["apps"] resources = ["deployments"] verbs = ["get", "list"] } } resource "kubernetesrolebinding" "example" { metadata { name = "terraform-example" namespace = "default" } role_ref { api_group = "rbac.authorization.k8s.io" kind = "Role" name = "role_name" } subject { kind = "User" name = "admin" api_group = "rbac.authorization.k8s.io" } subject { kind = "ServiceAccount" name = "default" namespace = "kube-system" } subject { kind = "Group" name = "system:masters" api_group = "rbac.authorization.k8s.io" } } ```