cartography
cartography copied to clipboard
Add Access Entries from EKS in Kubernetes Module
Title: *We are potentially missing coverage of many Kubernetes Users and Groups by not processing access entries from EKS. Right now we are just getting Users from the aws-auth-config-map and the RoleBindings and ClusterRole bindings. Processing Access Entries will allow us to get users and groups that aren't in the other 2 sources. *
Description:
- Access Entries live outside the cluster in EKS. Example of the json object that the AWS API returns for Access Entries
-
"accessEntry": { "clusterName": "eks-customer", "principalArn": "arn:aws:iam::111122223333:user/eks-admin-user", "kubernetesGroups": [], "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-admin-user/0acb1bc6-cb0a-ede6-11ae-a6506e3d36p0", "createdAt": "2025-04-14T22:45:48.097000-05:00", "modifiedAt": "2025-04-14T22:45:48.097000-05:00", "tags": {}, "username": "arn:aws:iam::111122223333:user/eks-admin-user", "type": "STANDARD" }
[optional Relevant Links:]
- look at intel/kubernetes/rbac.py to see how we ingest users and groups from the role bindings and cluster role bindings
- look at intel/kubernetes/eks.py to see how we ingest users and groups from the aws-auth-map