Restrict worker RAM role permissions

Prerequisites

Before you begin, make sure that you have:

• An ACK managed cluster (Pro or Basic) running Kubernetes 1.18 or later. Create an ACK managed cluster or manually upgrade a cluster if needed. Alternatively, migrate an ACK dedicated cluster to an ACK managed Pro cluster.

• Granted the default service roles required by the ACK managed cluster. For more information, see Grant permissions to service roles.

Step 1: Assess current permissions

Determine whether the worker RAM role has excess permissions that need to be restricted.

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. On the Basic Information tab, click the link next to Worker RAM Role.

3. In the RAM console, go to the Permissions tab of the Role page.

   • If there are no policies attached, no further action is needed. The worker RAM role has no extra permissions.

   • If policies are attached (for example, k8sWorkerRolePolicy-db8ad5c7***), the role may have more permissions than necessary. Evaluate against your business needs based on the principle of least privilege, then proceed to the next step.

Step 2: Upgrade add-ons

Historically, ACK add-ons relied on the node's worker RAM role for cloud resource access. Current ACK add-ons use token-based authentication (managed service roles) instead. Upgrade your cluster add-ons and analyze audit logs to remove unnecessary permissions from the worker RAM role and limit the impact of potential security incidents.

For more information, see Manage add-ons.

Step 3: Collect audit logs

Set up audit logging to track which Alibaba Cloud API operations the worker RAM role performs. This data tells you which permissions are still in use and which can be safely removed.

1. Log on to the ActionTrail console.

2. Create a single-account trail for the region where the cluster is located. When creating the trail, select Delivery to Log Service. For more information, see Create a single-account trail.

For the full list of services that ActionTrail supports, see Supported Alibaba Cloud services.

Step 4: Test cluster features

After upgrading add-ons and redeploying workloads, verify that core cluster features still work correctly.

Step 5: Analyze audit logs

After collecting logs for at least one week, query the data to identify which API operations the worker RAM role performed.

1. Log on to the Simple Log Service (SLS) console.

2. In the Projects section, click the project you specified in Step 3.

   

3. On the Log Storage > Logstore tab, click the destination Logstore. The Logstore is named actiontrail_<trail_name>.

4. Run the following query to list the API operations called through the Security Token Service (STS) token of the worker RAM role. Replace <worker_role_name> with the name of the worker RAM role for your cluster. The results show which Alibaba Cloud services and API operations are being called. Use this data in Step 6 to decide which permissions to keep and which to remove.

      * and event.userIdentity.userName: <worker_role_name> | select "event.serviceName", "event.eventName", count(*) as total GROUP BY "event.eventName", "event.serviceName"

Step 6: Remove unused permissions

Based on the audit log analysis, remove permissions that the worker RAM role does not need.

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. On the Basic Information tab, click the link next to Worker RAM Role.

3. On the Permissions tab of the Role page, click the destination access policy to go to the Policy Content tab. Click Modify Policy.

   Important

   Before you modify the policy document, back it up. This lets you roll back the permission configuration if needed.

4. Delete unnecessary permissions based on the audit log analysis from Step 5. For example, delete the Action permissions from the policy that were not invoked during your audit period. If the query returned no results, you can safely detach the entire policy from the role.

5. Redeploy the workloads using the commands listed in Step 2.

6. Repeat Steps 4, 5, and 6 until the worker RAM role has only the minimum permissions required by the add-ons or applications.

References

• For an overview of the ACK authorization system, see Best practices for authorization.