Cloud breaches from Kubernetes: Common misconfigurations with IRSA and RBAC.
Tags: eks, aws, kubernetes, security
Published: 2023-12-03 21:37:41

**Kubernetes** is a powerful container orchestration tool that has gained significant popularity in cloud-native and containerized applications. It has many advantages for your apps, such as scalability, high availability, portability, security, cost optimization, etc.
Despite its many advantages, **Kubernetes** can also be complex to set up and manage, especially for smaller and less experienced teams. However, its scalability, reliability, and portability benefits make it a compelling choice for many organizations in the containerized and cloud-native application world.
In that dynamic landscape of cloud computing, securing Kubernetes deployments is paramount to prevent potential breaches. This blog post will delve into two fundamental aspects of Kubernetes security: **IAM Roles for Service Accounts (IRSA)** and **Role-Based Access Control** (RBAC), highlighting their pivotal roles in fortifying cloud environments.

## Some Kubernetes stats

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0rjm6pg8kfplzvyfs48i.png)
All the advantages that Kubernetes provide attract any size organization, and combined with less experience but their engineers, could be a considerable risk of exposure to security breaches. Today's article will focus on the Kubernetes users within the AWS cloud infrastructure.

 ## AWS IAM and Kubernetes RBAC
AWS IAM authorization does not translate into EKS, which means defining the authorization within your AWS does not mean you need anything to Kubernetes. Kubernetes uses its authorization system called RBAC. Role-Based Access Control (RBAC) in Kubernetes defines what actions users or pods can perform within the cluster. Misconfigured RBAC settings can lead to excessive privileges or unauthorized access.
The Kubernetes API integrates with the AWS IAM Authenticator for Kubernetes, using a token authentication webhook. When started, it generates a webhook configuration file (which has the address of the authentication server and then saves it onto the host filesystem.
In the case of AWS, this is achieved by using a ConfigMap by the name of aws-auth within the kube-system namespace. This ConfigMap contains the entries of users and roles. 
Any users within AWS who want to access EKS need to either have an entry within that file or be attached to an IAM role that is entered within that file. Only the user or role who created the cluster has access by default..

## IRSA
IAM Roles for Service Accounts (IRSA) allow pods to securely access other AWS services without using AWS credentials. However, misconfigurations can result in unauthorized access or exposure of AWS credentials within pods.
Our experimentation today will concern some scenarios or common mistakes that newbies make.
There are a few things about URSA that you need to know:
* IRSA is bound to a service account for a specific EKS cluster.
* IRSA is located within only one namespace
* The service account needs to be mounted within the pod

## Scenario: Security breach with over-permissive IAM Roles
The following scenario will demonstrate how you can easily expose your AWS cloud environment.
Let's say we have a user called John Doe, a Developer at Nailabx. John Doe needs to have decent access to the dev Kubernetes cluster. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zzbqzsobxwt28x10bl0o.png)
John Doe has no access to AWS except for the console.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uqy450rnta4iujhzmc26.png)
The application deployed within the clusters pulls secrets, accesses databases, stores files within S3, and more.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/030hmeuleczy0c8hhvhc.png)
Let's demonstrate how John Doe can unauthorized access the database secret and s3 content.

## DEMO
Please follow this [link](https://github.com/nailabx/tuto-terraform-eks) to access the code repo.