documentation_complete: true


title: 'Restrict Automounting of Service Account Tokens'

description: |-
    Service accounts tokens should not be mounted in pods except where the workload
    running in the pod explicitly needs to communicate with the API server.
    To ensure pods do not automatically mount tokens, set
    <tt>automountServiceAccountToken</tt> to <tt>false</tt>.

rationale: |-
    Mounting service account tokens inside pods can provide an avenue
    for privilege escalation attacks where an attacker is able to
    compromise a single pod in the cluster.

severity: medium

references:
    cis@ocp4: 5.1.6
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'service account token usage needs review'

ocil: |-
    For each pod in the cluster, review the pod specification and
    ensure that pods that do not need to explicitly communicate with
    the API server have <tt>automountServiceAccountToken</tt>
    configured to <tt>false</tt>.
