Service account ‘automountServiceAccountToken’ should be set to ‘false’

Description

Avoid automounting service account tokens. Service account tokens are used to authenticate requests from in-cluster processes to the Kubernetes API server. Many workloads do not need to communicate with the API server and hence should have automountServiceAccountToken set to false.

Remediation Steps

Kubernetes Manifest (YAML)

Example Configuration

Pod:

apiVersion: v1
kind: Pod
metadata:
  name: hello
spec:
  automountServiceAccountToken: false
  containers:
    - name: hello
      image: busybox
      command: ['sh', '-c', 'echo "Hello, Kubernetes!" && sleep 3600']
# other required fields here

Service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: hello
automountServiceAccountToken: false
# other required fields here