Cloud and Kubernetes posture
Cerberon audits cloud accounts and Kubernetes clusters with read-only access. The Cerberon Agent reads the environment through the provider’s own tooling and maps each finding to a CIS benchmark control, for example CIS Kubernetes Benchmark v1.9.0 5.2.1.
Start an audit from New Scan > Cloud or New Scan > Kubernetes.
Credentials
Section titled “Credentials”Grant read-only permissions only. The audit never creates, changes or deletes a resource, and it can see only what the credential allows.
Credentials are entered on the Scan Details step and saved per project. They are encrypted with AES-256-GCM and passed only to that scan’s worker as environment variables. They never appear in the target, the job record, the event log or a browser response.
| Provider | Target | Credential fields |
|---|---|---|
| AWS | Account ID | Access key ID and secret access key (required). Region and session token (optional). |
| Microsoft Azure | Subscription ID | Tenant ID, client ID, client secret and subscription ID (all required). |
| Google Cloud | Project ID | Service account key JSON (required). Project ID (optional). |
| Kubernetes | Cluster name | A kubeconfig, or an API server URL with a bearer token. Context, namespace and CA certificate are optional. |
What is audited
Section titled “What is audited”Cloud accounts. IAM users, roles and policies, including privilege escalation paths, publicly exposed storage, and the other controls of the provider’s CIS benchmark.
Kubernetes clusters. Guided by the CIS Kubernetes Benchmark:
- RBAC: over-broad subjects and wildcard permissions in roles, cluster roles and bindings.
- Secrets: plaintext credentials and insecure secret configuration.
- Workloads: privileged containers,
hostPath,hostNetwork, missing security contexts and automounted service account tokens. - Network policy: missing or permissive policies.
Set Namespace to limit a Kubernetes audit to one namespace.