rage.fail

aws-eks-kubernetes-secret-data

Kubernetes Secret objects hold base64-encoded credential material and are readable through the cluster API when EKS access and Kubernetes RBAC allow it.

awscritical service: aws:eks emits CanReadSecret

Where it sits

location	`Kubernetes core/v1 Secret.data / stringData`
location kind	`secret_value`
data kinds	`credential` `password` `api_key` `access_key` `secret_key` `oauth_token` `private_key` `certificate` `connection_string`
emits edge	`CanReadSecret`
service	EKS (aws:eks)

Collection recipe

access mode	`data_plane`
operation	`Kubernetes GET /api/v1/secrets or /api/v1/namespaces/{namespace}/secrets`
response path	`items[].data.<value>`
encoding	`base64`
params	`{"ClusterName": "\u003ccluster\u003e", "Namespace": "\u003cnamespace\u003e"}`

Required permissions

eks:AccessKubernetesApi
eks:DescribeCluster

References

https://docs.aws.amazon.com/cli/latest/reference/eks/describe-cluster.html
https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html
https://servicereference.us-east-1.amazonaws.com/v1/eks/eks.json
https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html