cartography icon indicating copy to clipboard operation
cartography copied to clipboard

Add Access Entries from EKS in Kubernetes Module

Open shyammukund opened this issue 4 months ago • 0 comments

Title: *We are potentially missing coverage of many Kubernetes Users and Groups by not processing access entries from EKS. Right now we are just getting Users from the aws-auth-config-map and the RoleBindings and ClusterRole bindings. Processing Access Entries will allow us to get users and groups that aren't in the other 2 sources. *

Description:

  • Access Entries live outside the cluster in EKS. Example of the json object that the AWS API returns for Access Entries
  • "accessEntry": {
      "clusterName": "eks-customer",
      "principalArn": "arn:aws:iam::111122223333:user/eks-admin-user",
      "kubernetesGroups": [],
      "accessEntryArn": "arn:aws:eks:us-west-2:111122223333:access-entry/eks-customer/user/111122223333/eks-admin-user/0acb1bc6-cb0a-ede6-11ae-a6506e3d36p0",
      "createdAt": "2025-04-14T22:45:48.097000-05:00",
      "modifiedAt": "2025-04-14T22:45:48.097000-05:00",
      "tags": {},
      "username": "arn:aws:iam::111122223333:user/eks-admin-user",
      "type": "STANDARD"
    }
    
    
    

[optional Relevant Links:]

  • look at intel/kubernetes/rbac.py to see how we ingest users and groups from the role bindings and cluster role bindings
  • look at intel/kubernetes/eks.py to see how we ingest users and groups from the aws-auth-map

shyammukund avatar Aug 28 '25 21:08 shyammukund