aws-eks-pod-executes-as-pod-identity-role
A pod whose SA is linked via an EKS Pod Identity Association executes as the associated IAM role (credentials delivered by the pod-identity-agent DaemonSet at 169.254.170.23).
match (record)
{
"field": "roleArn",
"resource_type": "AWS::EKS::PodIdentityAssociation"
}
where
eks-pod-identity-agent DaemonSet is installed on the cluster (service_state)
emit
| source type | KubernetesWorkload |
|---|---|
| source | <KubernetesWorkload (any pod running as the namespace:SA specified in the association)> |
| target | <IAM Role from roleArn (MachineIdentity/Role)> |
| conditions | service_state |
| state logic | ACTIVE if eks-pod-identity-agent DaemonSet is confirmed installed; CONDITIONAL(service_state) if install is unknown; BLOCKED on Fargate profiles without Pod Identity agent (note: Pod Identity IS supported on Fargate as of 2024, via the agent-less Fargate path — check cluster addon status). |
Narrative
Pods running as ServiceAccount {sa.name} (namespace {namespace}) execute as IAM role {role.name} via EKS Pod Identity Association. Credentials are delivered by the eks-pod-identity-agent at http://169.254.170.23/v1/credentials.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-pod-executes-as-pod-identity-role
emits: ExecutesAs
description: A pod whose SA is linked via an EKS Pod Identity Association executes as the associated IAM
role (credentials delivered by the pod-identity-agent DaemonSet at 169.254.170.23).
match_record:
resource_type: AWS::EKS::PodIdentityAssociation
field: roleArn
where:
- eks-pod-identity-agent DaemonSet is installed on the cluster (service_state)
emit:
source_type: KubernetesWorkload
source: <KubernetesWorkload (any pod running as the namespace:SA specified in the association)>
target: <IAM Role from roleArn (MachineIdentity/Role)>
api_source: eks:DescribePodIdentityAssociation
evidence_field: roleArn
conditions:
- service_state
state_logic: "ACTIVE if eks-pod-identity-agent DaemonSet is confirmed installed; CONDITIONAL(service_state)\
\ if install is unknown; BLOCKED on Fargate profiles without Pod Identity agent (note: Pod Identity\
\ IS supported on Fargate as of 2024, via the agent-less Fargate path \u2014 check cluster addon status)."
narrative: Pods running as ServiceAccount {sa.name} (namespace {namespace}) execute as IAM role {role.name}
via EKS Pod Identity Association. Credentials are delivered by the eks-pod-identity-agent at http://169.254.170.23/v1/credentials.