Monitoring Unauthorized Amazon EKS Access Entry Modifications

Amazon EKS Access Entries allow administrators to map IAM principals to Kubernetes permissions, simplifying cluster authentication. Attackers can abuse this mechanism to gain persistent access or escalate privileges by creating, updating, or associating access policies with malicious or compromised IAM principals. Because these entries modify authentication mappings outside of standard in-cluster Kubernetes RBAC objects, they can be used to bypass existing security controls and maintain a foothold within the cluster environment. Defenders should monitor for unexpected changes to these entries that do not correlate with known infrastructure-as-code or automated deployment activities.

Impact

Successful abuse of EKS Access Entries can allow an attacker to gain persistent, unauthorized access to a Kubernetes cluster, potentially leading to unauthorized data access, lateral movement, or service disruption. Monitoring for these changes helps identify unauthorized privilege escalation or persistence efforts before they are leveraged for further malicious activity.

Recommendation

• Implement monitoring for the specific CloudTrail actions listed in the Sigma rule below to detect unauthorized cluster access changes.
• Review and baseline existing IAM roles utilized by deployment pipelines (e.g., terraform, eksctl) to reduce false positives in detection logic.
• Pair these alerts with Kubernetes audit log monitoring to track subsequent API activity performed by identities tied to newly created or updated access entries.
• Use AWS IAM and Service Control Policies (SCPs) to restrict access to EKS configuration APIs to authorized administrators only.