{"repo":"DataDog/managed-kubernetes-auditing-toolkit","free":true,"listed":false,"github":"https://github.com/DataDog/managed-kubernetes-auditing-toolkit","clone":"git clone https://github.com/DataDog/managed-kubernetes-auditing-toolkit.git","description":"All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments. Currently supports Amazon EKS.","language":"Go","stars":386,"topics":["kubernetes","aws-eks","aws-security","eks","kubernetes-security","managed-kubernetes"],"license":"Apache-2.0","category":"deployment-docker-iac","readme_excerpt":"Managed Kubernetes Auditing Toolkit (MKAT) MKAT is an all-in-one auditing toolkit for identifying common security issues within managed Kubernetes environments. It is focused on Amazon EKS at the moment, and will be extended to other managed Kubernetes environments in the future. Features: - 🔎 Identify trust relationships between K8s service accounts and AWS IAM roles - supports both IAM Roles for Service Accounts (IRSA), and Pod Identity, released on November 26 2023. - 🔑 Find hardcoded AWS credentials in K8s resources. - 💀 Test if pods can access the AWS Instance Metadata Service (IMDS). Installation ... or use a pre-compiled binary. Then, make sure you are authenticated against your cluster, and to AWS. MKAT uses your current AWS and kubectl authentication contexts. In particular, you might need to set your AWS REGION and AWS PROFILE environment variables, if using profiles. Features Identify trust relationships between K8s service accounts and AWS IAM roles MKAT can identify the trust relationships between K8s service accounts and AWS IAM roles, and display them in a table or as a graph. It currently supports: - IAM Roles for Service Accounts , a popular mechanism to allow pods to assume AWS IAM roles by exchanging a Kubernetes service account token for AWS credentials through the AWS STS API ( AssumeRoleWithWebIdentity ). - EKS Pod Identity , another newer mechanism that works in a similar way, but is easier to set up. MKAT works by analyzing both the IAM roles in the","default_branch":null,"files":null,"tree":[],"storefront":"/r/DataDog","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/DataDog/managed-kubernetes-auditing-toolkit/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}