Описание
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
Меры по смягчению последствий
Migrate from CCO Mint mode to STS mode (AWS Security Token Service), which eliminates long-lived IAM users and uses short-lived role-scoped OIDC tokens. Alternatively, switch to CCO Manual mode or Passthrough mode. If mode migration is not immediately feasible, manually restrict the IAM policies on CCO-provisioned IAM users by adding tag-based conditions scoping destructive actions to resources tagged with kubernetes.io/cluster/=owned. For S3 actions, restrict Resource to the specific registry bucket ARN rather than "*". Enterprise defense-in-depth: deploy AWS Service Control Policies (SCPs) to deny destructive actions from non-approved principals, and apply IAM Permission Boundaries to CCO-created users.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cloud-credential-operator | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cloud-credential-rhel9-operator | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.2 High
CVSS3
Связанные уязвимости
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.
EPSS
7.2 High
CVSS3