Authorization at the server side layer

#!/usr/bin/env bash
# ABOUTME: Wires AWS IAM Access Analyzer findings to EventBridge to a SIEM-shipping Lambda.
# ABOUTME: Run per-region (Access Analyzer is regional). Requires events:PutRule and events:PutTargets in the operator's profile.

set -euo pipefail

REGION="${AWS_REGION:-us-east-1}"
RULE_NAME="${RULE_NAME:-access-analyzer-findings}"
LAMBDA_ARN="${LAMBDA_ARN:-}"

if [[ -z "${AWS_PROFILE:-}" ]]; then
  echo "Set AWS_PROFILE to a profile with events:PutRule." >&2
  exit 1
fi
if [[ -z "$LAMBDA_ARN" ]]; then
  echo "Set LAMBDA_ARN to the SIEM-shipping Lambda's ARN." >&2
  exit 1
fi

aws --profile "$AWS_PROFILE" --region "$REGION" events put-rule \
  --name "$RULE_NAME" \
  --description "Access Analyzer findings to SIEM" \
  --event-pattern '{"source":["aws.access-analyzer"],"detail-type":["Access Analyzer Finding"]}' \
  --state ENABLED

aws --profile "$AWS_PROFILE" --region "$REGION" events put-targets \
  --rule "$RULE_NAME" \
  --targets "Id=1,Arn=$LAMBDA_ARN"

# Lambda must have permission to be invoked by EventBridge. Add this once per
# Lambda, not per region.
aws --profile "$AWS_PROFILE" --region "$REGION" lambda add-permission \
  --function-name "$LAMBDA_ARN" \
  --statement-id "${RULE_NAME}-invoke" \
  --action lambda:InvokeFunction \
  --principal events.amazonaws.com \
  --source-arn "arn:aws:events:${REGION}:$(aws --profile "$AWS_PROFILE" sts get-caller-identity --query Account --output text):rule/${RULE_NAME}" \
  2>/dev/null || true   # idempotent: already-exists is fine

echo "EventBridge rule $RULE_NAME wired to $LAMBDA_ARN in $REGION."
echo "Repeat for every region where Access Analyzer is enabled."

# ABOUTME: OPA config that streams decision logs to the SIEM, filtered to deny decisions only.
# ABOUTME: Without filtering, OPA emits one event per admission decision and floods the SIEM.
decision_logs:
  console: false
  service: siem
  reporting:
    min_delay_seconds: 5
    max_delay_seconds: 30
  # Drop allow decisions; keep only denies. Tune per your alerting needs.
  mask_decision: |
    package system.log
    mask["/result"] {
      input.result == true
    }

services:
  - name: siem
    url: https://siem.example.com:9200/opa-decisions/_doc
    credentials:
      bearer:
        token: ${SIEM_TOKEN}
    # Index per day so retention rotation works.
    response_header_timeout_seconds: 5

# ABOUTME: CronJob that ships Kyverno PolicyReports with summary.fail > 0 to the SIEM every 5 minutes.
# ABOUTME: kubectl image is pinned by digest; replace before applying. SIEM_TOKEN comes from a Secret.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kyverno-reporter
  namespace: kyverno
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kyverno-reporter-read
rules:
- apiGroups: ["wgpolicyk8s.io"]
  resources: ["policyreports", "clusterpolicyreports"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kyverno-reporter-read
subjects:
- kind: ServiceAccount
  name: kyverno-reporter
  namespace: kyverno
roleRef:
  kind: ClusterRole
  name: kyverno-reporter-read
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Secret
metadata:
  name: siem-credentials
  namespace: kyverno
type: Opaque
stringData:
  SIEM_TOKEN: "REPLACE_WITH_BEARER_TOKEN"
  SIEM_URL: "https://siem.example.com:9200/agent-sentinel-policy/_doc"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ship-policy-reports
  namespace: kyverno
spec:
  schedule: "*/5 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: kyverno-reporter
          restartPolicy: OnFailure
          containers:
          - name: shipper
            # Pin by digest. Resolve current digest with: crane digest bitnami/kubectl:1.34
            image: bitnami/kubectl@sha256:REPLACE_WITH_DIGEST_FROM_CRANE
            envFrom:
            - secretRef:
                name: siem-credentials
            command: ["/bin/sh", "-c"]
            args:
            - |
              set -eu
              kubectl get policyreports,clusterpolicyreports -A -o json \
              | jq -c '.items[] | select(.summary.fail > 0) | {
                  event: "policy_report",
                  namespace: (.metadata.namespace // "cluster"),
                  policy: (.metadata.labels."policy.kyverno.io/policy-name" // ""),
                  failed: .summary.fail,
                  results: [.results[] | select(.result == "fail")],
                  ts: (now | strftime("%Y-%m-%dT%H:%M:%SZ"))
                }' \
              | while IFS= read -r line; do
                  curl -sS -X POST "$SIEM_URL" \
                    -H "Authorization: Bearer $SIEM_TOKEN" \
                    -H "Content-Type: application/json" \
                    -d "$line"
                done

# ABOUTME: Sigma rule firing when an agent namespace accumulates >10 RBAC denials within 5 minutes.
# ABOUTME: Probing or misconfiguration indicator. Filter on auth-can-i checks if those flood at baseline.
title: RBAC denial spike in agent namespace
id: 8c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: >
  Detects more than 10 RBAC denials within a 5-minute window in any single
  agent namespace. Either an agent probing for a permission gap or an
  in-progress misconfiguration. The rule excludes "kubectl auth can-i" style
  preflight checks because those denial-by-design events are baseline noise.
references:
  - https://github.com/peopleforrester/agentic-covenants/blob/main/SENTINELS_MATRIX.md
author: agentic-covenants
date: 2026/05/08
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    user.username|startswith: 'system:serviceaccount:agent-'
    annotations.authorization.k8s.io/decision: 'forbid'
  filter_can_i:
    requestURI|contains: '/access-review'
  timeframe: 5m
  condition: (selection and not filter_can_i) | count(objectRef.namespace) > 10
falsepositives:
  - First-deploy of a new agent (the missing permissions show up as a wave).
  - Operator running an exploratory script under the agent SA (treat as a tuning signal).
level: medium
tags:
  - agent
  - authorization
  - sentinels