<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-kubernetes-rbac-in-cloud
description: >-
  Audit Kubernetes RBAC configurations in managed cloud services (EKS, AKS, GKE)
  to detect overprivileged roles, excessive cluster-admin bindings, misconfigured
  service accounts, and namespace isolation failures.
domain: cybersecurity
subdomain: cloud-security
tags:
  - kubernetes
  - rbac
  - eks
  - aks
  - gke
  - cluster-admin
  - service-accounts
  - namespace-isolation
  - pod-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1613"]
---

# Auditing Kubernetes RBAC in Cloud

## Overview

Managed Kubernetes services (EKS, AKS, GKE) inherit both cloud IAM and Kubernetes
RBAC complexity. Overprivileged ClusterRoleBindings, wildcard permissions, default
service account token mounting, and missing namespace isolation create lateral movement
paths. This skill audits RBAC configurations in managed Kubernetes using kubectl,
cloud-native tools, and purpose-built scanners to enforce least-privilege access.

Mode: `[MODE: BLUE]` — Kubernetes security posture assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| `kubectl` configured with cluster access | Required |
| AWS | `aws eks update-kubeconfig` for EKS clusters |
| Azure | `az aks get-credentials` for AKS clusters |
| GCP | `gcloud container clusters get-credentials` for GKE clusters |
| Python 3.10+ with `kubernetes` client library | Required |

## Key Concepts

### Cluster-Admin Binding Audit

```bash
# Find all ClusterRoleBindings to cluster-admin
kubectl get clusterrolebindings -o json | jq '
  .items[] | select(.roleRef.name == "cluster-admin") |
  {name: .metadata.name, subjects: .subjects}'

# Count cluster-admin bindings (should be minimal)
kubectl get clusterrolebindings -o json | jq '
  [.items[] | select(.roleRef.name == "cluster-admin")] | length'

# Find ClusterRoles with wildcard permissions
kubectl get clusterroles -o json | jq '
  .items[] | select(.rules[]? | .resources[]? == "*" and .verbs[]? == "*") |
  {name: .metadata.name, rules: .rules}'
```

### Service Account Audit

```bash
# Find pods using default service account
kubectl get pods --all-namespaces -o json | jq '
  .items[] | select(.spec.serviceAccountName == "default" or .spec.serviceAccountName == null) |
  {namespace: .metadata.namespace, pod: .metadata.name, sa: (.spec.serviceAccountName // "default")}'

# Find service accounts with automountServiceAccountToken enabled
kubectl get serviceaccounts --all-namespaces -o json | jq '
  .items[] | select(.automountServiceAccountToken != false) |
  {namespace: .metadata.namespace, name: .metadata.name}'

# Find service accounts bound to cluster-admin
kubectl get clusterrolebindings -o json | jq '
  .items[] | select(.roleRef.name == "cluster-admin") |
  select(.subjects[]? | .kind == "ServiceAccount") |
  {binding: .metadata.name, serviceAccounts: [.subjects[] | select(.kind == "ServiceAccount")]}'
```

### Namespace Isolation

```bash
# Find namespaces without NetworkPolicies
for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
  NP=$(kubectl get networkpolicies -n "$ns" --no-headers 2>/dev/null | wc -l)
  [ "$NP" -eq 0 ] && echo "[MEDIUM] $ns — No NetworkPolicies defined"
done

# Find namespaces without ResourceQuotas
for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
  RQ=$(kubectl get resourcequotas -n "$ns" --no-headers 2>/dev/null | wc -l)
  [ "$RQ" -eq 0 ] && echo "[LOW] $ns — No ResourceQuotas defined"
done
```

### Cloud-Specific IAM Integration

```bash
# EKS — review aws-auth ConfigMap
kubectl get configmap aws-auth -n kube-system -o yaml

# EKS — check IRSA (IAM Roles for Service Accounts)
kubectl get serviceaccounts --all-namespaces -o json | jq '
  .items[] | select(.metadata.annotations["eks.amazonaws.com/role-arn"] != null) |
  {namespace: .metadata.namespace, sa: .metadata.name, role: .metadata.annotations["eks.amazonaws.com/role-arn"]}'

# AKS — check Azure AD integration
az aks show --name $CLUSTER --resource-group $RG --query "aadProfile"

# GKE — check Workload Identity
gcloud container clusters describe $CLUSTER --zone=$ZONE \
  --format="value(workloadIdentityConfig.workloadPool)"
```

## Workflow

### Step 1: Connect to Cluster

```bash
# EKS
aws eks update-kubeconfig --name $CLUSTER --region $REGION

# AKS
az aks get-credentials --name $CLUSTER --resource-group $RG

# GKE
gcloud container clusters get-credentials $CLUSTER --zone $ZONE
```

### Step 2: Run Automated Audit

```bash
node scripts/agent.js --context $(kubectl config current-context) --output /tmp/k8s_rbac.json
```

## Detection

```yaml
title: Auditing Kubernetes Rbac In Cloud Detection
id: 06243ec3-e4cc-412c-b53e-d12c4cf79b56
status: experimental
description: Detects suspicious activity related to auditing kubernetes rbac in cloud techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1613
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Kubernetes Rbac In Cloud Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1613 |

## Verification

- [ ] cluster-admin bindings limited to break-glass accounts
- [ ] No ClusterRoles with wildcard verb+resource permissions
- [ ] Default service account not used by workloads
- [ ] automountServiceAccountToken=false on unused service accounts
- [ ] NetworkPolicies defined in all application namespaces
- [ ] Cloud IAM-to-RBAC mapping reviewed (aws-auth, Azure AD, Workload Identity)
- [ ] Pod Security Standards enforced at namespace level

## References

- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)
- [MITRE ATT&CK — Containers Matrix](https://attack.mitre.org/matrices/enterprise/containers/)
- [EKS Security Best Practices](https://aws.github.io/aws-eks-best-practices/security/)
- [GKE Hardening Guide](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster)
