aws-eks-cluster-admin-exec-command

A principal with Kubernetes cluster-admin RBAC (system:masters binding or equivalent ClusterRole: cluster-admin) can exec into any pod in any namespace via pods/exec. This gives OS-level code execution and access to the pod's mounted SA token / IRSA credential. Matches CanModifyConfiguration on the cluster (indicating cluster-admin access establishment).

derived aws emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'cluster': None}

where

?principal was granted cluster-admin RBAC on ?cluster (directly or via system:masters group) node_type(?cluster) == KubernetesCluster

emit

source type	`Identity`
target type	`KubernetesWorkload`
source	`?principal`
target	`<any KubernetesWorkload (pod) running in ?cluster>`
permissions	`eks:DescribeCluster`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when the cluster-admin RBAC is in effect (access entry created, or system:masters group membership confirmed) AND the cluster Kubernetes API is reachable (public endpoint, or private endpoint with network foothold). eks:DescribeCluster is the IAM prerequisite to bootstrap kubectl access to the cluster endpoint. The actual exec capability is the Kubernetes RBAC verb 'pods/exec create' (not an IAM action). CONDITIONAL(service_state) if the endpoint is private-only and network reachability from the attacker's position is unconfirmed. This edge feeds container-chains cluster-rbac-exec for each pod's ExecutesAs.

Narrative

{principal.name} holds Kubernetes cluster-admin RBAC on {cluster.name}. It can run kubectl exec (pods/exec create) on any pod in any namespace, getting OS-level command execution inside the container and access to its mounted ServiceAccount/IRSA token. eks:DescribeCluster is the IAM prerequisite to bootstrap kubectl access to the cluster endpoint.

Raw rule rules/derived/aws/eks.yaml

id: aws-eks-cluster-admin-exec-command
emits: CanExecuteCommand
description: 'A principal with Kubernetes cluster-admin RBAC (system:masters binding or equivalent ClusterRole:
  cluster-admin) can exec into any pod in any namespace via pods/exec. This gives OS-level code execution
  and access to the pod''s mounted SA token / IRSA credential. Matches CanModifyConfiguration on the cluster
  (indicating cluster-admin access establishment).'
match:
- - principal: null
  - CanModifyConfiguration
  - cluster: null
where:
- ?principal was granted cluster-admin RBAC on ?cluster (directly or via system:masters group)
- node_type(?cluster) == KubernetesCluster
emit:
  source_type: Identity
  target_type: KubernetesWorkload
  source: ?principal
  target: <any KubernetesWorkload (pod) running in ?cluster>
  permissions:
  - eks:DescribeCluster
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when the cluster-admin RBAC is in effect (access entry created, or system:masters
    group membership confirmed) AND the cluster Kubernetes API is reachable (public endpoint, or private
    endpoint with network foothold). eks:DescribeCluster is the IAM prerequisite to bootstrap kubectl
    access to the cluster endpoint. The actual exec capability is the Kubernetes RBAC verb 'pods/exec
    create' (not an IAM action). CONDITIONAL(service_state) if the endpoint is private-only and network
    reachability from the attacker's position is unconfirmed. This edge feeds container-chains cluster-rbac-exec
    for each pod's ExecutesAs.
  confidence: 0.95
  derived_from:
  - ?principal CanModifyConfiguration ?cluster (cluster-admin via aws-eks-access-entry-cluster-admin-config-control)
  - cluster-admin k8s RBAC grants pods/exec create across all namespaces
  false_positive_note: "Requires actual cluster-admin RBAC to be in effect \u2014 the CanModifyConfiguration\
    \ edge from aws-eks-access-entry-cluster-admin-config-control establishes this once the access entry\
    \ is CREATED. The attacker must also be able to reach the Kubernetes API server endpoint (public endpoint,\
    \ or private endpoint with a VPC foothold). eks:DescribeCluster is the IAM bootstrap action; the actual\
    \ exec verb (pods/exec create) is Kubernetes RBAC, not an IAM action. BLOCKED if the cluster is API-private-only\
    \ and the attacker has no VPC access. Do not emit for namespace-scoped RBAC roles."
  narrative: '{principal.name} holds Kubernetes cluster-admin RBAC on {cluster.name}. It can run kubectl
    exec (pods/exec create) on any pod in any namespace, getting OS-level command execution inside the
    container and access to its mounted ServiceAccount/IRSA token. eks:DescribeCluster is the IAM prerequisite
    to bootstrap kubectl access to the cluster endpoint.'