medium
advisory
AWS EKS: Creation or Modification of Sensitive RBAC Roles
This detection identifies the creation or modification of Kubernetes Roles and ClusterRoles that include high-risk permissions, such as wildcard access or RBAC escalation verbs (bind, escalate, impersonate), which may facilitate privilege escalation or unauthorized access.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 21, 09:07 UTC
- Source quality
- B2Roughly even chance
The creation or modification of Roles and ClusterRoles with high-risk RBAC permissions can silently expand privileges within an EKS cluster. Attackers may add a ClusterRole with wildcard (*) verbs or resources to bind themselves or service accounts to cluster-admin - equivalent access. Legitimate administrative or automated tasks may also trigger this activity; therefore, changes should be validated against expected operational workflows or version-controlled manifests.
Recommendation
- Monitor EKS control-plane audit logs for the creation or modification of Roles and ClusterRoles.
- Investigate the identity and origin of changes, verifying if they originated from approved automation or interactive sessions.
- Compare Role/ClusterRole manifests before and after the change to identify the introduction of wildcard access or escalation verbs (bind, escalate, impersonate).
- Review associated RoleBindings or ClusterRoleBindings to determine which subjects gained effective permissions.
- Utilize RBAC guardrails (e.g., OPA Gatekeeper or Kyverno) to restrict wildcard or escalation verbs to approved groups.