Back to Checks
kubernetes

User or group does not have permission to create service account tokens

rbac_minimize_service_account_token_creation
Service: rbacSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesscluster-security
Resource Type:ClusterRoleBinding

Cluster-wide RBAC identifies users or groups granted create on serviceaccounts/token via ClusterRoles/ClusterRoleBindings.

Highlights principals allowed to mint service account tokens through the TokenRequest subresource.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Ability to mint service account tokens lets users assume those accounts' API rights, bypassing intended boundaries.

This enables privilege escalation, persistent access, and lateral movement, threatening confidentiality and integrity of cluster resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks rbac_minimize_service_account_token_creation

Recommendation

Enforce least privilege: avoid granting create on serviceaccounts/token to human users or broad groups. Restrict to trusted controllers and scope narrowly with namespaced Role/RoleBinding.

Apply separation of duties, periodic RBAC reviews, and defense in depth to limit token issuance.

Remediation

CLI

kubectl delete clusterrolebinding <example_resource_name>

Other

1Identify the ClusterRoleBinding that grants a User/Group the role with create on serviceaccounts/token
2Edit the referenced ClusterRole and remove any rule that allows create on resource "serviceaccounts/token":
3- kubectl edit clusterrole <example_resource_name>
4- In .rules[], delete entries with resources: ["serviceaccounts/token"] and verb: ["create"]
5If the permission is only needed for other subjects, alternatively remove the specific User/Group from the ClusterRoleBinding:
6- kubectl edit clusterrolebinding <example_resource_name>
7- Delete the matching subject under .subjects and save

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.rbac.lib.role_permissions import (
    is_rule_allowing_permissions,
)
from prowler.providers.kubernetes.services.rbac.rbac_client import rbac_client

verbs = ["create"]
resources = ["serviceaccounts/token"]


class rbac_minimize_service_account_token_creation(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        # Collect unique subjects and the ClusterRole names bound to them
        subjects_bound_roles = {}
        for crb in rbac_client.cluster_role_bindings.values():
            for subject in crb.subjects:
                # CIS benchmarks scope these checks to human identities only
                if subject.kind in ["User", "Group"]:
                    key = (subject.kind, subject.name, subject.namespace)
                    if key not in subjects_bound_roles:
                        subjects_bound_roles[key] = (subject, set())
                    subjects_bound_roles[key][1].add(crb.roleRef.name)

        cluster_roles_by_name = {
            cr.metadata.name: cr for cr in rbac_client.cluster_roles.values()
        }
        for _, (subject, role_names) in subjects_bound_roles.items():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
            report.resource_name = f"{subject.kind}:{subject.name}"
            report.resource_id = f"{subject.kind}/{subject.name}"
            report.status = "PASS"
            report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens."
            for role_name in role_names:
                cr = cluster_roles_by_name.get(role_name)
                if cr and is_rule_allowing_permissions(cr.rules, resources, verbs):
                    report.status = "FAIL"
                    report.status_extended = f"User or group '{subject.name}' has access to create service account tokens."
                    break
            findings.append(report)

        return findings

References