mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-18 17:34:17 +00:00
fix(k8s): disambiguate RBAC findings by prefixing resource_id with subject kind
- Override resource_id and resource_name to "kind/name" format in all five deduplicated RBAC checks so User and Group with the same name produce distinct findings
This commit is contained in:
5 files changed
+10
No files matched your search
+2
@@ -23,6 +23,8 @@ class rbac_minimize_csr_approval_access(Check):
|
||||
|
||||
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
|
||||
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
|
||||
report.resource_id = f"{subject.kind}/{subject.name}"
|
||||
report.resource_name = f"{subject.kind}/{subject.name}"
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource."
|
||||
for cr in rbac_client.cluster_roles.values():
|
||||
|
||||
+2
@@ -23,6 +23,8 @@ class rbac_minimize_node_proxy_subresource_access(Check):
|
||||
|
||||
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
|
||||
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
|
||||
report.resource_id = f"{subject.kind}/{subject.name}"
|
||||
report.resource_name = f"{subject.kind}/{subject.name}"
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource."
|
||||
for cr in rbac_client.cluster_roles.values():
|
||||
|
||||
+2
@@ -23,6 +23,8 @@ class rbac_minimize_pv_creation_access(Check):
|
||||
|
||||
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
|
||||
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
|
||||
report.resource_id = f"{subject.kind}/{subject.name}"
|
||||
report.resource_name = f"{subject.kind}/{subject.name}"
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes."
|
||||
for cr in rbac_client.cluster_roles.values():
|
||||
|
||||
+2
@@ -23,6 +23,8 @@ class rbac_minimize_service_account_token_creation(Check):
|
||||
|
||||
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
|
||||
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
|
||||
report.resource_id = f"{subject.kind}/{subject.name}"
|
||||
report.resource_name = f"{subject.kind}/{subject.name}"
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens."
|
||||
for cr in rbac_client.cluster_roles.values():
|
||||
|
||||
+2
@@ -26,6 +26,8 @@ class rbac_minimize_webhook_config_access(Check):
|
||||
|
||||
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
|
||||
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
|
||||
report.resource_id = f"{subject.kind}/{subject.name}"
|
||||
report.resource_name = f"{subject.kind}/{subject.name}"
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations."
|
||||
for cr in rbac_client.cluster_roles.values():
|
||||
|
||||
Reference in new issue
Block a user