Role or ClusterRole does not grant create permission on pods

Check ID: rbac_minimize_pod_creation_access
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ClusterRole

What this check verifies

Kubernetes RBAC Roles and ClusterRoles that grant the create verb on pods are identified. Rules are examined to find permissions allowing pod creation at namespace or cluster scope.

Risk

Overly broad pod-creation rights allow adversaries to run malicious pods, mount service account tokens, or request privileged configs, enabling lateral movement. This endangers confidentiality (secrets), integrity (unauthorized changes), and availability (resource abuse, disruption).

Recommendation

Apply least privilege: limit pods create to narrowly scoped service accounts and namespaces. Use separation of duties and avoid wildcards. Enforce controls with Pod Security Admission and policy engines (OPA/Kyverno) to block risky specs. Review RBAC regularly and remove unused grants.

Remediation

CLI
Terraform
Dashboard steps

kubectl patch clusterrole <CLUSTERROLE_NAME> -p '{"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get","list","watch"]}]}'

resource "kubernetes_cluster_role_v1" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "list", "watch"] # critical: omit "create" to prevent pod creation and pass the check
  }
}

Identify the failing RBAC object (Role or ClusterRole) that allows pods create
For a ClusterRole: run kubectl edit clusterrole <CLUSTERROLE_NAME>
For a namespaced Role: run kubectl edit role <ROLE_NAME> -n <NAMESPACE>
In rules, find entries with resources: ["pods"] and remove create from verbs (keep only read verbs like get/list/watch)
Save and exit; verify with kubectl get that the change applied

References

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_pod_creation_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

No user or group can read the nodes/proxy sub-resource User or group has no permission to create PersistentVolumes

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires