Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
EKS audit-log behaviours V-029
Reads the cluster audit log for pod exec, secret listing, new cluster role bindings, anonymous requests and aws-auth edits.
Checks
| Checks | Needs |
|---|---|
| Flags a cluster request with no credential that the cluster allowed. | eksaudit anonymous |
| Flags a change to who may do what in a cluster made by anyone other than the deployer. | eksaudit rbac write |
| Flags any write to the aws-auth map of cloud identities to cluster identities. | eksaudit awsauth write |
| Flags a request that acted as the deployer's service account or as one of Warden's own. | eksaudit self admission |
| Flags a token minted for a system or deployer service account by anyone but the control plane. | eksaudit self admission |
| Flags a write into Warden's own namespace by anyone other than the deployer. | eksaudit self admission |
| Flags a shell opened in, or an attach to, a running pod. | eksaudit sensitive verb |
| Flags a person listing or watching Secrets in a cluster. | eksaudit sensitive verb |
| Flags a long-lived service-account token used to call the cluster. | eksaudit legacy token |
| Flags one identity refused many times across many kinds of request. | eksaudit denied |
| Flags one identity, not the deployer, deleting many objects in a cluster. | eksaudit delete |
| Flags a node's identity used from somewhere that is not that node. | eksaudit node identity, ec2 eni, ec2 instance, iam instance profile |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
kubectl get clusterrolebinding -o yaml / DescribeAccessEntry → remove the binding or access policy through GitOps; reversible