Back to Checks
alibabacloud

Kubernetes cluster has RBAC authorization enabled

cs_kubernetes_rbac_enabled
Service: csSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Kubernetes Engine clusters should have RBAC enabled for fine-grained authorization. RBAC lets administrators define roles with specific permissions at cluster and namespace level, ensuring users and service accounts access only needed resources. Legacy ABAC grants broad, static permissions and should be disabled in favor of RBAC.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without RBAC, clusters may rely on legacy ABAC which grants overly broad permissions that cannot be scoped to specific namespaces or resources. This increases the risk of unauthorized access and privilege escalation, where a compromised account could access sensitive resources across the cluster, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_rbac_enabled

Recommendation

Ensure RBAC is enabled on all Kubernetes Engine clusters and that legacy ABAC authorization is disabled. Configure RBAC roles and bindings through the ACK Console Authorizations page to enforce least-privilege access.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id> --header 'Content-Type=application/json' | jq '.parameters.KubernetesVersion'

Other

1Log on to the **ACK Console**.
2Navigate to **Clusters** -> **Authorizations** page.
3Select the target RAM sub-account and configure the RBAC roles on specific clusters or namespaces.
4Ensure **RBAC** is enabled and legacy ABAC authorization is disabled.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_rbac_enabled(Check):
    """Check if RBAC authorization is enabled on Kubernetes Engine Clusters."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.rbac_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Kubernetes cluster {cluster.name} has RBAC authorization enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not have RBAC authorization enabled or is using legacy ABAC authorization."

            findings.append(report)

        return findings

References