<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-pod-identity-management
description: >-
  Implement and audit Kubernetes pod identity using service accounts, IRSA,
  workload identity federation, projected tokens, and bound token volumes
  to enforce least-privilege cloud IAM from pod workloads.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - pod-identity
  - service-account
  - irsa
  - workload-identity
  - iam
  - least-privilege
  - oidc
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Implementing Pod Identity Management

## Overview

Pods accessing cloud APIs need identities scoped to least privilege. Legacy
approaches use static credentials or node-level roles — both violate zero-trust.
Modern pod identity binds Kubernetes service accounts to cloud IAM via OIDC
federation (AWS IRSA, GCP Workload Identity, Azure Workload Identity).

Mode: `[MODE: ARCHITECT]` — Design pod identity. `[MODE: BLUE]` — Detect over-privileged pods.

## Prerequisites

| Requirement | Details |
|---|---|
| EKS >= 1.28 / GKE >= 1.28 / AKS >= 1.28 | Required |
| OIDC provider configured on cluster | Required |
| kubectl and cloud CLI (aws/gcloud/az) configured | Required |

## Key Concepts

### Disable Automount of Default Token

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: minimal-sa
  namespace: production
automountServiceAccountToken: false
```

### AWS IRSA Configuration

```bash
# Create OIDC provider for EKS
eksctl utils associate-iam-oidc-provider \
  --cluster my-cluster --approve

# Create IAM role with trust policy scoped to SA
aws iam create-role --role-name pod-role \
  --assume-role-policy-document file://trust-policy.json

# Annotate service account
kubectl annotate serviceaccount app-sa \
  --namespace production \
  eks.amazonaws.com/role-arn=arn:aws:iam::ACCOUNT:role/pod-role
```

### GCP Workload Identity

```bash
# Enable workload identity on cluster
gcloud container clusters update my-cluster \
  --workload-pool=PROJECT_ID.svc.id.goog

# Bind KSA to GSA
gcloud iam service-accounts add-iam-policy-binding \
  GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"

# Annotate KSA
kubectl annotate serviceaccount KSA_NAME \
  --namespace NAMESPACE \
  iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com
```

### Audit Pod Identity Bindings

```bash
# Find pods using default service account
kubectl get pods -A -o json | \
  jq '.items[] | select(.spec.serviceAccountName == "default") |
  {namespace: .metadata.namespace, pod: .metadata.name}'

# Find SAs with automount enabled
kubectl get serviceaccount -A -o json | \
  jq '.items[] | select(.automountServiceAccountToken != false) |
  {namespace: .metadata.namespace, name: .metadata.name}'

# Check for static AWS credentials in env vars
kubectl get pods -A -o json | \
  jq '.items[].spec.containers[].env[]? |
  select(.name | test("AWS_ACCESS_KEY|AWS_SECRET")) | .name'
```

## Workflow

```bash
# Step 1: Audit current pod identity posture
node scripts/agent.js --action audit --namespace production

# Step 2: Review findings
cat /tmp/pod-identity-audit.json | jq '.findings[]'

# Step 3: Remediate over-privileged service accounts
kubectl apply -f hardened-sa-configs/
```

## Detection

```yaml
title: Pod Identity Management Detection
id: 8e1f66af-9595-451d-8434-14dbd54b9815
status: experimental
description: Detects suspicious activity related to implementing pod identity management techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Pod Identity Management Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004 |

## Verification

- [ ] No pods use the default service account in production namespaces
- [ ] automountServiceAccountToken is false on all non-essential SAs
- [ ] IRSA / Workload Identity bound with least-privilege IAM roles
- [ ] No static cloud credentials in pod environment variables or secrets
- [ ] Token expiry configured with projected service account tokens
- [ ] IAM roles scoped to specific resources, not wildcard

## References

- [EKS IRSA Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
- [GKE Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
- [Azure Workload Identity](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
- [NIST SP 800-190 — Container Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
