EKS Pod Identity associations should not bind AWS permissions to the default service account

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

EKS Pod Identity associations should bind AWS permissions to dedicated, explicitly named Kubernetes service accounts rather than the namespace default service account. Sharing the default service account across unrelated workloads weakens least privilege, increases blast radius, and reduces audit clarity when a Pod is compromised. This check evaluates Pod Identity associations only; Kubernetes workload manifests and token auto-mounting settings are not visible through the available resource schema.

Remediation

Create a dedicated service account for each workload and update the EKS Pod Identity association to reference it instead of default. See Amazon EKS Pod Identities.

References