Adding EKS pod Identities tag control

Service-specific-controls/README.md

@@ -41,6 +41,11 @@
 |[Deny deletion and only allow specific roles](Cognito-Deny-deletion-and-only-allow-specific-roles.json) |Prevent accidental or intentional deletion of Cognito user pools or domains, except by specific privileged roles. Replace `[PRIVILEGED_ROLE]` with the actual role name authorized to perform deletions.|
 
 
+**AWS STS**
+
+| Included Policy | Rationale | 
+|-------------|-------------|
+|[Protect EKS Pod Identity Session Tags](STS-ProtectEKSPodIdentitiesTags.json) | Protect the session tags set by EKS pod identities. This RCP helps ensure that only AWS service principals can assume IAM role sessions with the EKS pod identity specific session tags, while allowing the role-sessions assumed by EKS pod identities to continue to set them as transitive session tags. This pairs well with a service control policy that restricts the ability for someone to use the iam:TagRole and iam:TagUser permission from creating tags on IAM roles and users with the expected keys and valued by EKS pod identities. The logic is that "Only an AWS service Principal can makea request for a role-session with any of those tags, or a session/role/user that already has one of those tags set".|
 
 
 

Service-specific-controls/STS-ProtectEKSPodIdentitiesTags.json

@@ -0,0 +1,37 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "EnforceOnlyAWSServicePrincipalsAndRolesAssumedByEKSCanSetEKSSessiontTags",
+      "Effect": "Deny",
+      "Principal": "*",
+      "Action": [
+        "sts:TagSession"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "ForAnyValue:StringEquals": {
+          "aws:TagKeys": [
+            "eks-cluster-arn",
+            "eks-cluster-name",
+            "kubernetes-namespace",
+            "kubernetes-service-account",
+            "kubernetes-pod-name",
+            "kubernetes-pod-uid"
+          ]
+        },
+        "BoolIfExists": {
+          "aws:PrincipalIsAwsService": "false"
+        },
+        "Null": {
+          "aws:PrincipalTag/eks-cluster-arn": "true",
+          "aws:PrincipalTag/eks-cluster-name": "true",
+          "aws:PrincipalTag/kubernetes-namespace": "true",
+          "aws:PrincipalTag/kubernetes-service-account": "true",
+          "aws:PrincipalTag/kubernetes-pod-name": "true",
+          "aws:PrincipalTag/kubernetes-pod-uid": "true"
+        }
+      }
+    }
+  ]
+}