Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Cluster-admin surface V-012
Finds bindings, roles, access entries and aws-auth mappings that hand out cluster administrator rights.
Checks
| Checks | Needs |
|---|---|
| Catches access entries created or widened, and says whether the deployer did it. | Live events: eks |
| Finds bindings that grant cluster-admin, or any role to anonymous or every authenticated principal. | k8s rbac binding, k8s rbac role |
| Finds cluster roles that grant wildcard rights, cluster-wide secret reads, escalation or pod exec. | k8s rbac role |
| Finds aws-auth mappings that put an IAM principal in system:masters. | k8s aws auth |
| Says when the aws-auth mapping could not be parsed. | k8s aws auth |
| Finds changes to the principals aws-auth maps since the last run. | k8s aws auth |
| Finds legacy service account tokens still signing in to the API server. | k8s metrics |
| Finds access entries that grant cluster-admin. | eks access entry |
| Finds clusters whose creator still holds administrator rights. | eks cluster |
Coverage
Read everywhere
‹payments-prod-cluster› | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
kubectl get clusterrolebinding -o yaml / DescribeAccessEntry → remove the binding or access policy through GitOps; reversible