Skip to content
Threat Feed
Subscribe
high advisory

AWS EKS: Kubernetes secret enumeration detection

Detection of potential credential enumeration in AWS EKS via monitoring of control-plane audit logs for sensitive namespace or cluster-wide secret listing operations.

Triage facts

Revision 1
Applicability
Amazon Elastic Kubernetes Service (EKS)
Evidence
Unknown
Severity
High
Sources
1 public source
Freshness
Revision 1Oct 21, 08:31 UTC
Source quality
B2Roughly even chance

Elastic has released a detection rule to identify 'list' operations on Kubernetes Secrets within AWS EKS clusters. The rule monitors for operations targeting '/api/v1/secrets' or namespaces such as 'kube-system' and 'default' when initiated from non-loopback IP addresses. This monitoring is intended to identify potential credential enumeration from remote clients. The implementation requires EKS control-plane audit logs to be enabled and ingested into the 'logs-aws.eks_audit-*' data stream.

Recommendation

  • Enable AWS EKS audit log streaming to the AWS integration.
  • Deploy the detection logic to identify unauthorized service account or user access.
  • Investigate findings by confirming the actor and reviewing the source IP, user agent, and follow-on API activity.
  • If listing is unauthorized, revoke credentials, rotate exposed secrets, and tighten RBAC to ensure only required service accounts can list secrets in sensitive namespaces.