User or group has no permission to create PersistentVolumes

Check ID: rbac_minimize_pv_creation_access
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ClusterRoleBinding

What this check verifies

Kubernetes RBAC mapping of users or groups with the create verb on persistentvolumes through ClusterRoleBindings. Shows which principals can provision PersistentVolumes cluster-wide.

Risk

With create on persistentvolumes, a principal can define hostPath PVs and mount them via claims, exposing node files and bypassing pod safeguards. Results include secret disclosure and filesystem tampering (confidentiality/integrity), and potential node compromise affecting availability.

Recommendation

Enforce least privilege: permit create on persistentvolumes only for trusted storage controllers and select administrators. Adopt dynamic provisioning, maintain separation of duties, and use defense in depth (Pod Security and admission policies) to prevent unsafe volumes like hostPath.

Remediation

CLI
Terraform
Dashboard steps

kubectl delete clusterrolebinding <example_resource_name>

resource "kubernetes_cluster_role" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }

  rule {
    api_groups = [""]
    resources  = ["persistentvolumes"]
    verbs      = ["get", "list", "watch"]
    # Critical: exclude "create" on persistentvolumes to prevent PV creation
    # This removes the permission that caused the FAIL finding.
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_pv_creation_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Role or ClusterRole does not grant create permission on pods No Role or ClusterRole grants broad access to Secrets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires