aws-eks-node-executes-as-role
Each EC2 instance in an EKS managed node group runs as the node group IAM role (nodeRole).
match (record)
{
"field": "nodeRole",
"resource_type": "AWS::EKS::Nodegroup"
}
emit
| source type | Compute |
|---|---|
| source | <EC2 instance (VirtualMachine) in the node group> |
| target | <nodeRole ARN (MachineIdentity/Role)> |
Narrative
EC2 node in EKS node group {nodegroup.name} executes as node IAM role {role.name} (nodeRole). All pods on this node can potentially reach the node role's credentials via IMDS (hop-limit dependent).
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-node-executes-as-role
emits: ExecutesAs
description: Each EC2 instance in an EKS managed node group runs as the node group IAM role (nodeRole).
match_record:
resource_type: AWS::EKS::Nodegroup
field: nodeRole
emit:
source_type: Compute
source: <EC2 instance (VirtualMachine) in the node group>
target: <nodeRole ARN (MachineIdentity/Role)>
api_source: eks:DescribeNodegroup
evidence_field: nodeRole
narrative: EC2 node in EKS node group {nodegroup.name} executes as node IAM role {role.name} (nodeRole).
All pods on this node can potentially reach the node role's credentials via IMDS (hop-limit dependent).