Role or ClusterRole does not use wildcard resources or verbs

Check ID: rbac_minimize_wildcard_use_roles
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ClusterRole

What this check verifies

Kubernetes RBAC Roles/ClusterRoles are evaluated for wildcard use in rule resources or verbs. The presence of * means all resources or all actions are granted. This finding highlights roles whose rules include such wildcards.

Risk

Using * broadens access beyond intent:

Confidentiality: unrestricted reads of sensitive data
Integrity/Availability: create/update/delete across resources
Privilege escalation and lateral movement
Future drift: new APIs/verbs inherit access automatically

Recommendation

Apply least privilege: replace * with explicit resources, verbs, and resourceNames. Split read/write duties, scope Roles to namespaces, use ClusterRoles only when needed, and bind to specific subjects. Periodically review roles to prevent privilege creep as part of defense in depth.

Remediation

CLI
Terraform
Dashboard steps

kubectl patch clusterrole <example_resource_name> --type=merge -p '{"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get"]}]}'

resource "kubernetes_cluster_role_v1" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }

  rule {
    api_groups = [""]
    resources  = ["pods"]  # critical: replace wildcard resources with specific resource
    verbs      = ["get"]   # critical: replace wildcard verbs with specific verb
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_wildcard_use_roles. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

No user or group can modify webhook configurations Scheduler pod has --bind-address set to 127.0.0.1

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires