For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-tc0.md. A documentation index is available at /llms.txt.

The kubeconfig file should have permissions set to 644 or more restrictive

eks

Description

AWS EKS worker node kubeconfig files should have permissions set to 644 or more restrictive. The kubelet kubeconfig file contains authentication credentials the kubelet uses to connect to the Kubernetes API server, so restricting write access to administrators preserves the integrity of the kubelet configuration and reduces the risk of malicious alterations that could compromise the cluster.

Remediation

On each worker node, run the following command (adjusting the path to the kubeconfig file location on your system) to restrict the file permissions. See the Kubernetes cluster hardening documentation for more detail.

chmod 644 /var/lib/kubelet/kubeconfig

Note: The path above is the default location in EKS.

References