Skip to main content

K8s Audit Log Role Bindings To System

This alert occurs when Lacework detects a user on your Kubernetes cluster successfully created a role binding to bind the user to system: prefixed role.

Why this alert is important​

The prefix system: is reserved for Kubernetes system use. There are many system: prefixed default roles which can render clusters inoperable if they are tampered with.

Investigation​

Follow these steps to investigate the alert:

  1. Check the Kubernetes audit logs to identify when and by whom the role binding was created.
  2. Identify the user or group that was granted the system: prefixed role. You can find this information in the subjects field of the RoleBinding object.

Resolution​

Follow these steps to resolve the alert:

  1. If the role binding was created maliciously or in error, remove it immediately to prevent further unauthorized access or activity.
  2. Change the credentials of any users who may have been involved in creating the unauthorized role binding, and revoke their access if necessary.
  3. Review all users' permissions and access levels and ensure they are appropriate for their job functions. Remove any excessive permissions that could lead to potential security breaches.
  4. Conduct a thorough security audit of the affected cluster to identify other security vulnerabilities or suspicious activity.
  5. Implement additional security measures such as multi-factor authentication, network segmentation, and regular security training for users to prevent future security incidents.