Back to all scenarios
Scenario #231
Security
K8s v1.20, AWS EKS
Insufficiently Secured Service Account Permissions
Service accounts were granted excessive permissions, giving pods access to resources they did not require, leading to a potential security risk.
Find this helpful?
What Happened
A service account used by multiple pods had broader permissions than needed. This allowed one compromised pod to access sensitive resources across the cluster, including secrets and privileged services.
Diagnosis Steps
- 1Audited service account configurations and found that many pods were using the same service account with excessive permissions.
- 2Investigated the logs and identified that the compromised pod was able to access restricted resources.
Root Cause
Service accounts were granted overly broad permissions, violating the principle of least privilege.
Fix/Workaround
• Created specific service accounts for each pod with minimal necessary permissions.
• Applied strict RBAC rules to restrict access to sensitive resources for service accounts.Lessons Learned
Use fine-grained permissions for service accounts to reduce the impact of a compromise.
How to Avoid
- 1Regularly audit service accounts and ensure they follow the principle of least privilege.
- 2Implement namespace-level access control to limit service account scope.