Check ID: rbac_minimize_service_account_token_creation
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ClusterRoleBinding

​
What this check verifies

Cluster-wide RBAC identifies users or groups granted create on serviceaccounts/token via ClusterRoles/ClusterRoleBindings. Highlights principals allowed to mint service account tokens through the TokenRequest subresource.

​
Risk

Ability to mint service account tokens lets users assume those accounts’ API rights, bypassing intended boundaries. This enables privilege escalation, persistent access, and lateral movement, threatening confidentiality and integrity of cluster resources.

​
Recommendation

Enforce least privilege: avoid granting create on serviceaccounts/token to human users or broad groups. Restrict to trusted controllers and scope narrowly with namespaced Role/RoleBinding. Apply separation of duties, periodic RBAC reviews, and defense in depth to limit token issuance.

​
Remediation

kubectl delete clusterrolebinding <example_resource_name>

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_service_account_token_creation. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks