aws-eks-rbac-pods-exec
A Kubernetes RBAC subject (user/group/SA) holding pods/exec create verb on a namespace can exec into any pod in that namespace.
match (record)
{
"field": "subjects + roleRef (pods/exec create verb)",
"resource_type": "k8s:ClusterRoleBinding | k8s:RoleBinding"
}
where
roleRef resolves to a ClusterRole or
Role with rules including verbs=[create] resources=[pods/exec]
subject maps to an IAM principal via access entry or aws-auth ConfigMap
emit
| source type | Identity |
|---|---|
| source | <IAM principal (mapped from k8s subject via access entry or aws-auth)> |
| target | <KubernetesWorkload (pod in the namespace scope of the binding)> |
| conditions | service_state |
| state logic | ACTIVE when the cluster API endpoint is reachable and the binding is in effect. CONDITIONAL(service_state) for private-only endpoints without confirmed VPC foothold. |
Narrative
IAM principal {principal.name} (mapped to k8s subject {subject.name}) holds the pods/exec create verb in {scope} via ClusterRoleBinding/RoleBinding to {role.name}. It can kubectl exec into any pod in {scope} and run OS commands in the container.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-rbac-pods-exec
emits: CanExecuteCommand
description: A Kubernetes RBAC subject (user/group/SA) holding pods/exec create verb on a namespace can
exec into any pod in that namespace.
match_record:
resource_type: k8s:ClusterRoleBinding | k8s:RoleBinding
field: subjects + roleRef (pods/exec create verb)
where:
- roleRef resolves to a ClusterRole or Role with rules including verbs=[create] resources=[pods/exec]
- subject maps to an IAM principal via access entry or aws-auth ConfigMap
emit:
source_type: Identity
source: <IAM principal (mapped from k8s subject via access entry or aws-auth)>
target: <KubernetesWorkload (pod in the namespace scope of the binding)>
permissions: []
api_source: kubectl get clusterrolebindings,rolebindings -o json
evidence_field: rules[].verbs / resources
conditions:
- service_state
state_logic: ACTIVE when the cluster API endpoint is reachable and the binding is in effect. CONDITIONAL(service_state)
for private-only endpoints without confirmed VPC foothold.
narrative: IAM principal {principal.name} (mapped to k8s subject {subject.name}) holds the pods/exec
create verb in {scope} via ClusterRoleBinding/RoleBinding to {role.name}. It can kubectl exec into
any pod in {scope} and run OS commands in the container.