Kubernetes Remote Scanner

The following permissions are required for Cloud Security (InsightCloudSec) to access the Elastic Kubernetes Service (EKS):

"eks:DescribeCluster",
"eks:ListClusters"

The following permissions are required for Cloud Security (InsightCloudSec) to retrieve the credentials needed to authenticate and connect to AKS clusters for scanning purposes:

"actions": [
  "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
  "Microsoft.ContainerService/managedClusters/read"
]

The following data-level permissions are required for Cloud Security (InsightCloudSec) to read all cluster resources and create subjectaccessreviews to validate access permissions within the Kubernetes cluster:

"dataActions": [
  "Microsoft.ContainerService/managedClusters/*/read",
  "Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write"
]

The following permissions/roles are needed for a service account in order to scan a Kubernetes cluster in the Google Kubernetes Engine (GKE):

• Kubernetes Engine Cluster Viewer (roles/container.clusterViewer)
  • Provides access to get and list GKE clusters and get cluster credentials.
  • Note: This role is a subset of the Kubernetes Engine Viewer role (roles/container.viewer)
  • Provides permissions: container.clusters.get, container.clusters.list, resourcemanager.projects.get, resourcemanager.projects.list
• Kubernetes Engine Viewer (roles/container.viewer)
  • Provides read-only access to resources within GKE clusters, such as nodes, pods, and GKE API objects
  • Review the GCP documentation  for more information about the permissions this role provides
• Permission needed for secrets visibility and validation: container.secrets.list
• Permission needed for subjectaccessreview creation: container.subjectAccessReviews.create

To update an existing AWS IAM role for an access entry using AWS CloudShell:

1. Log in to the AWS console  for the target account.

2. Open the AWS CloudShell.

3. Create the access entry for your existing Cloud Security (InsightCloudSec) role:

   aws eks create-access-entry --cluster-name {your-cluster-name} --principal-arn arn:aws:iam::{account-id}:role/rapid7/{your-role-name}

4. Associate the AmazonEKSAdminViewPolicy with the access entry:

   aws eks associate-access-policy --cluster-name {your-cluster-name} --principal-arn arn:aws:iam::{account-id}:role/rapid7/{your-role-name} --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy --access-scope type=cluster

To configure a new AWS IAM role:

1. Log in to Cloud Security (InsightCloudSec).

2. Go to Cloud > Cloud Accounts and click the target account’s name.

3. Go to Settings > Additional Settings

4. In the Update EKS Scanner Role section, select or create a new separate role.

5. Click Save.

6. Log in to the AWS console  for the target account.

7. Open the AWS CloudShell.

8. Create the access entry for the new role:

   aws eks create-access-entry --cluster-name {your-cluster-name} --principal-arn arn:aws:iam::{account-id}:role/rapid7/{your-role-name}

9. Associate the AmazonEKSAdminViewPolicy with the access entry:

   aws eks associate-access-policy --cluster-name {your-cluster-name} --principal-arn arn:aws:iam::{account-id}:role/rapid7/{your-role-name} --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy --access-scope type=cluster

Once you complete the steps to provide Read Access Permissions to EKS, Kubernetes access will be configured and the cluster will begin harvesting (assuming it is not in a paused state in Cloud Security (InsightCloudSec)).

To create and assign a custom role using the Azure CLI:

1. On your local machine, create a JSON file named ics-kubernetes-role.json with the following content, replacing YOUR_SUBSCRIPTION_ID with your actual subscription ID:

   {
       "Name": "ICS Kubernetes Read All/Create subjectaccessreview",
       "Description": "Role that allows a user to read all resources on a kubernetes cluster and create subjectaccessreviews",
       "AssignableScopes": [
           "/subscriptions/YOUR_SUBSCRIPTION_ID"
       ],
       "Actions": [
           "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
           "Microsoft.ContainerService/managedClusters/read"
       ],
       "NotActions": [],
       "DataActions": [
           "Microsoft.ContainerService/managedClusters/*/read",
           "Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write"
       ],
       "NotDataActions": []
   }

2. Run the following command in the same directory as your JSON file:

   az role definition create --role-definition ics-kubernetes-role.json

3. Assign the custom role to your Cloud Security (InsightCloudSec) Azure Application:

   az role assignment create --assignee <APPLICATION_ID> --role "ICS Kubernetes Read All/Create subjectaccessreview" --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"

Kubernetes access is now configured and the cluster will begin harvesting (assuming it is not in a paused state in Cloud Security (InsightCloudSec)).

To create and assign a custom role using the Azure Portal:

1. Log in to the Azure Portal  as an admin user for the account that hosts your Cloud Security (InsightCloudSec) Application.
2. Find your subscription, then go to Access control (IAM) > Roles.
3. Click + Add > Add custom role
4. Enter the Basics:
   • Name: ICS Kubernetes Read All/Create subjectaccessreview
   • Description: Role that allows a user to read all resources on a Kubernetes cluster and create subjectaccessreviews
   • Assignable scope: Select your subscription.
5. Click the Permissions tab.
6. Click Add permissions and add the following:
   • Actions:
     • Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
     • Microsoft.ContainerService/managedClusters/read
   • Data Actions:
     • Microsoft.ContainerService/managedClusters/*/read
     • Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write
7. Click Review + create to create the role.
8. Go to Access control (IAM).
9. Click + Add > Add role assignment.
10. Search for and select the new ICS Kubernetes Read All/Create subjectaccessreview role.
11. Click Next.
12. For the Members:
    • Leave Assign access to as the default (User, group, or service principal).
    • Click + Select members.
    • Search for and select your InsightCloudSec Azure Application. Click Select.
13. Click Review + assign to complete the role assignment.

Kubernetes access is now configured and the cluster will begin harvesting (assuming it is not in a paused state in Cloud Security (InsightCloudSec)).