Back to Checks
kubernetes

Role or ClusterRole does not use wildcard resources or verbs

rbac_minimize_wildcard_use_roles
Service: rbacSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesscluster-security
Resource Type:ClusterRole

Kubernetes RBAC Roles/ClusterRoles are evaluated for wildcard use in rule resources or verbs. The presence of * means all resources or all actions are granted. This finding highlights roles whose rules include such wildcards.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Using * broadens access beyond intent:

  • Confidentiality: unrestricted reads of sensitive data
  • Integrity/Availability: create/update/delete across resources
  • Privilege escalation and lateral movement
  • Future drift: new APIs/verbs inherit access automatically

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks rbac_minimize_wildcard_use_roles

Recommendation

Apply least privilege: replace * with explicit resources, verbs, and resourceNames. Split read/write duties, scope Roles to namespaces, use ClusterRoles only when needed, and bind to specific subjects. Periodically review roles to prevent privilege creep as part of defense in depth.

Remediation

CLI

kubectl patch clusterrole <example_resource_name> --type=merge -p '{"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get"]}]}'

Terraform

resource "kubernetes_cluster_role_v1" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }

  rule {
    api_groups = [""]
    resources  = ["pods"]  # critical: replace wildcard resources with specific resource
    verbs      = ["get"]   # critical: replace wildcard verbs with specific verb
  }
}

Other

1Run: kubectl edit clusterrole <example_resource_name>
2In rules, replace any resources: ["*"] with only the needed resources (e.g., ["pods"]).
3Replace any verbs: ["*"] with only required verbs (e.g., ["get"]).
4Save and exit. Repeat for any Role or ClusterRole still using wildcards.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.rbac.rbac_client import rbac_client


class rbac_minimize_wildcard_use_roles(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        # Check ClusterRoles for wildcards
        for cr in rbac_client.cluster_roles.values():
            report = Check_Report_Kubernetes(
                metadata=self.metadata(), resource=cr.metadata
            )
            report.status = "PASS"
            report.status_extended = (
                f"ClusterRole {cr.metadata.name} does not use wildcards."
            )

            for rule in cr.rules:
                if (rule.resources and "*" in str(rule.resources)) or (
                    rule.verbs and "*" in rule.verbs
                ):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ClusterRole {cr.metadata.name} uses wildcards."
                    )
            findings.append(report)

        # Check Roles for wildcards
        for role in rbac_client.roles.values():
            report = Check_Report_Kubernetes(
                metadata=self.metadata(), resource=role.metadata
            )
            report.status = "PASS"
            report.status_extended = (
                f"Role {role.metadata.name} does not use wildcards."
            )

            for rule in role.rules:
                if (rule.resources and "*" in str(rule.resources)) or (
                    rule.verbs and "*" in rule.verbs
                ):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Role {role.metadata.name} uses wildcards."
                    )
            findings.append(report)

        return findings

References