T05 · Unauthorized Access and Privilege Escalation
- Location
README.md:51- Finding
Documentation Encourages Unnecessary Cluster-Wide Administrative Access
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 51–88
Vulnerability Type: Excessive privilege provisioning and access-control expansion
Risk Level: HighVulnerable Code
bash aws eks update-cluster-config \ --name <cluster-name> \ --access-config authenticationMode=API_AND_CONFIG_MAPbash aws eks create-access-entry \ --cluster-name <cluster-name> \ --principal-arn arn:aws:iam::<account-id>:role/<ec2-role-name> \ --type STANDARD aws eks associate-access-policy \ --cluster-name <cluster-name> \ --principal-arn arn:aws:iam::<account-id>:role/<ec2-role-name> \ --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \ --access-scope type=clusterThe same instructions are duplicated in
README_CN.md, lines 48–84.Technical Analysis
The skill describes a workload assessment based mainly on read-only
kubectl, EKS, ECR, and CloudWatch queries. Its documented operations do not require cluster-wide administrative authority.The prerequisite instructions nevertheless tell users to:
- Change the cluster authentication mode to
API_AND_CONFIG_MAP. - Create an EKS Access Entry for an EC2 instance role.
- associate
AmazonEKSClusterAdminPolicywith that role at cluster scope.
Changing the authentication mode modifies the cluster's security configuration and enables an additional access-management mechanism. Assigning
AmazonEKSClusterAdminPolicyat cluster scope gives the selected principal broad administrative control over the EKS cluster. This violates least privilege because the permissions materially exceed those needed to enumerate and assess workloads.The documentation states that users should adjust the policy and that a more restrictive policy is preferable in production. However, the directly copyable example still provisions cluster administrator access, making the insecure option the default path.
Attack Path
- An operator follows the documented prerequ ...[truncated 1662 chars]
- Change the cluster authentication mode to
- Remediation
View remediation
Remediation Suggestions
- Remove authentication-mode mutation and administrator provisioning from the assessment prerequisites. Present them only as exceptional troubleshooting procedures, clearly separated from the normal workflow.
- Require an existing dedicated assessment identity with read-only permissions.
- Provide a least-privilege EKS Access Entry example instead of
AmazonEKSClusterAdminPolicy. - Prefer namespace-scoped access when the assessment targets specific namespaces. Avoid
--access-scope type=clusterunless the user explicitly requests a full-cluster assessment and cluster-level reads are essential. - Define Kubernetes RBAC that grants only the required
get,list, and, where necessary,watchverbs for the resource types enumerated by the assessment. - Define a limited AWS IAM policy for required read operations, such as relevant
eks:Describe*,eks:List*,ecr:Describe*,ecr:GetLifecyclePolicy, and necessary CloudWatch read actions. - Do not grant write operations such as
eks:UpdateClusterConfig,eks:CreateAccessEntry, oreks:AssociateAccessPolicyto the routine assessment identity. - Require explicit user confirmation and a security-impact warning before any cluster authentication configuration is changed.
- Apply short-lived credentials, audit logging, and periodic review to any assessment Access Entry. Remove temporary entries immediately after use.
- Update the duplicate instructions in
README_CN.md, lines 48–84, so that the insecure administrative example is not retained in translated documentation.