Check ID: rbac_minimize_secret_access
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, secrets, cluster-security
Resource type: ClusterRole

​
What this check verifies

RBAC Roles and ClusterRoles granting read permissions to Kubernetes Secrets are identified. The evaluation looks for rules that allow get, list, or watch on secrets, either namespace-scoped or cluster-wide.

​
Risk

Excessive Secret read access compromises confidentiality of tokens, keys, and credentials. Attackers can harvest service account tokens to impersonate workloads, pivot across namespaces, and modify resources, threatening integrity and availability via lateral movement.

​
Recommendation

Apply least privilege: avoid granting get, list, or watch on secrets except to narrowly scoped subjects. Constrain by namespace and resourceNames where feasible, use dedicated service accounts, avoid wildcards, and enforce separation of duties with policy and reviews.

​
Remediation

# Remove secret read permissions by ensuring no rule includes the "secrets" resource
resource "kubernetes_cluster_role" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  rule {
    api_groups = [""]
    resources  = ["pods"] # Critical: do NOT include "secrets" to avoid get/list/watch on Secrets
    verbs      = ["get"]
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_secret_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks