apiVersion: config.stackrox.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: bm-01-ensure-that-default-service-accounts-are-not-actively-used-plus-elevated-access
spec:
  policyName: '[BM 01] Ensure that default service accounts are not actively used  PLUS Elevated Access'
  description: '[BM 01] Ensure that default service accounts are not actively used  PLUS Elevated Access'
  rationale: Default service accounts have broad permissions and should not be used by applications
  remediation: Create dedicated service accounts for applications with minimal required permissions
  categories:
    - Security Best Practices
  lifecycleStages:
    - DEPLOY
  eventSource: NOT_APPLICABLE
  severity: MEDIUM_SEVERITY
  policySections:
    - sectionName: Container Configuration
      policyGroups:
        - fieldName: Service Account
          booleanOperator: OR
          values:
            - value: default
        - fieldName: Minimum RBAC Permissions
          booleanOperator: OR
          values:
            - value: ELEVATED_CLUSTER_WIDE
    - sectionName: Rule 2
      policyGroups:
        - fieldName: Service Account
          booleanOperator: OR
          values:
            - value: default
        - fieldName: Minimum RBAC Permissions
          booleanOperator: OR
          values:
            - value: ELEVATED_IN_NAMESPACE
    - sectionName: Rule 3
      policyGroups:
        - fieldName: Service Account
          booleanOperator: OR
          values:
            - value: default
        - fieldName: Minimum RBAC Permissions
          booleanOperator: OR
          values:
            - value: CLUSTER_ADMIN
  mitreAttackVectors:
    - tactic: TA0004
      techniques:
        - T1078
  criteriaLocked: false
  mitreVectorsLocked: false
  isDefault: false
