successMessage: The Role does not allow pods/exec or pods/attach
failureMessage: The Role allows Pods/exec or pods/attach
category: Security
target: rbac.authorization.k8s.io/Role
schemaString: |
  '$schema': https://json-schema.org/draft/2019-09/schema
  type: object
  required: ["metadata", "rules"]
  anyOf:
    # Do not alert on default Roles.
    - properties:
        metadata:
          required: ["name"]
          properties:
            name:
              type: string
              anyOf:
                - pattern: '^system:'
                - const: "gce:podsecuritypolicy:calico-sa"
    - properties:
        metadata:
          required: ["name"]
          properties:
            name:
              type: string
        rules:
          type: array
          items:
            type: object
            not:
              required: ["apiGroups", "resources", "verbs"]
              properties:
                apiGroups:
                  type: array
                  contains:
                    type: string
                    anyOf:
                      - const: ""
                      - const: '*'
                resources:
                  type: array
                  contains:
                    type: string
                    anyOf:
                      - const: '*'
                      - const: "pods/exec"
                      - const: "pods/attach"
                verbs:
                  type: array
                  contains:
                    type: string
                    anyOf:
                      - const: '*'
                      # An exec is also possible by `get`ing a web socket.
                      - const: 'get'
                      - const: 'create'