medium
advisory
AWS EKS: Potential Unauthorized Kubernetes Secret access
Kubernetes audit identities for kubelet (system:node:*) and workloads (system:serviceaccount:*) performing 'get' or 'list' operations on Secret objects may indicate credential access, as attackers use these methods to sweep for tokens, registry credentials, TLS keys, or application configuration.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 21, 07:46 UTC
- Source quality
- B2Roughly even chance
Kubernetes audit identities (system:node:* and system:serviceaccount:*) are intended to operate with predictable API usage. Direct 'get' or 'list' operations on the Secrets API by these principals can be a sign of credential access, as compromised tokens or node credentials may be used to exfiltrate sensitive material.
Investigation Guidance
- Review RBAC RoleBindings and ClusterRoleBindings for the identified node or workload.
- Inspect the namespace, object name, source IP, and user agent to differentiate between recognized automation and anomalous activity.
- Review authorization decisions in the audit logs to distinguish successful reads from probing denials.
- Correlate activity with other events such as pod execs, token creation, or RoleBinding modifications.
False Positives
- In-cluster operators, CSI drivers, GitOps agents, and platform controllers may legitimately interact with Secrets.
- Rare kubelet or node maintenance tooling may access Secret APIs.