cis-eks-v170-4-1-7

name	cis-eks-v170-4.1.7
description	Cluster Access Manager API to streamline and enhance the management of access controls within EKS clusters (Automated)
category	cis-eks
version	1.7.0
author	cyberstrike-official
tags	["cis","eks","kubernetes","aws","rbac","service-accounts","access-manager","iam","configmap"]
cis_id	4.1.7
cis_benchmark	CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.7.0
tech_stack	["kubernetes","aws","eks"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.1.7 Cluster Access Manager API to streamline and enhance the management of access controls within EKS clusters (Automated)

Profile Applicability

• Level 1

Description

Amazon EKS has introduced the Cluster Access Manager API to streamline and enhance the management of access controls within EKS clusters. This new approach is now the recommended method over the traditional aws-auth ConfigMap for managing Role-Based Access Control (RBAC) and Service Accounts.

Key Advantages of Using the Cluster Access Manager API:

1. Simplified Access Management: The Cluster Access Manager API allows administrators to manage access directly through the Amazon EKS API, eliminating the need to modify the aws-auth ConfigMap manually. This reduces operational overhead and minimizes the risk of misconfigurations.
2. Enhanced Security Controls: With this API, administrators can assign predefined AWS-managed Kubernetes permissions, known as "access policies," to IAM principals. This provides a more secure and auditable way to manage permissions compared to manual ConfigMap edits.
3. Improved Visibility and Auditing: The API offers better visibility into cluster access configurations, facilitating easier auditing and compliance checks. Administrators can list and describe access entries and policies directly through the EKS API.

Rationale

The compelling rationale for using the Cluster Access Manager API instead of the traditional aws-auth ConfigMap in Amazon EKS revolves around security, scalability, operational efficiency, and simplified management.

1. Increased Security and Reduced Risk:

   • Direct Management via API: The Cluster Access Manager API enables you to manage RBAC and IAM permissions directly through the EKS API rather than editing a ConfigMap. This eliminates the risk of inadvertent errors when manually modifying the aws-auth ConfigMap.
   • Immutable Access Entries: The API ensures that once access entries are defined, they are tightly controlled, reducing the risk of accidental overwrites or misconfigurations that can happen when editing YAML files.
   • Fine-Grained Access Control: By leveraging the new API, you can define access policies at a more granular level than the previous method. This ensures that only the necessary permissions are granted, minimizing the attack surface.

2. Operational Efficiency and Scalability:

   • Scalability: Managing access control through the aws-auth ConfigMap becomes increasingly challenging as the number of users and services grows. The new API scales better by allowing access management through standard AWS Identity and Access Management (IAM) tools.