Skip to content
Threat Feed
Subscribe
high advisory

Amazon EKS: Improper TokenRequest API usage detection

Attackers can abuse the Kubernetes TokenRequest API to mint service account tokens without filesystem access, facilitating privilege escalation and movement to cloud resources via IAM Roles for Service Accounts (IRSA).

Triage facts

Revision 5
Applicability
Elastic Kubernetes Service (EKS)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
10 public sources
Freshness
Revision 5Oct 21, 09:08 UTC
Detection
2 rules
Source quality
A1Likely
Revision history 4 entries · Revision 5
  1. Revision 5

    added detection rule: Detect Authorized Anonymous Requests to EKS API

    Changed: lastmod, references, rules, tags, ttps, updates

    Sources: 1

  2. Revision 4

    added coverage for Elastic Kubernetes Service (EKS)

    Changed: lastmod, references, severity, tags, ttps, updates

    Sources: 1

  3. Revision 3

    added coverage for Elastic Kubernetes Service (EKS)

    Changed: lastmod, references, updates

    Sources: 1

  4. Revision 2

    added coverage for Elastic Kubernetes Service (EKS)

    Changed: lastmod, references, tags, ttps, updates

    Sources: 1

The Kubernetes TokenRequest API allows identities with appropriate RBAC permissions to programmatically generate short-lived tokens for service accounts. Because this process occurs via the API server, the resulting tokens do not leave traditional filesystem footprints, evading file-based monitoring. In Amazon EKS environments, attackers who have gained initial cluster access can leverage this API to mint tokens for highly privileged service accounts, effectively bypassing security controls meant to protect mounted secrets.

Impact

Successful abuse of the TokenRequest API enables attackers to impersonate privileged service accounts, perform unauthorized cluster operations, or gain access to AWS cloud resources through IRSA (IAM Roles for Service Accounts).

Recommendation

  • Enable and ingest EKS control-plane audit logs into your SIEM as defined in the AWS integration documentation for aws.eks_audit.
  • Deploy the detection rules provided below to monitor for create events against the serviceaccounts/token subresource by non-system identities.
  • Review RBAC policies across the cluster to identify and restrict create permissions on the serviceaccounts/token subresource to only strictly necessary service accounts or users.
  • Audit existing tokens minted via TokenRequest by correlating aws.eks.audit.annotations.authentication_kubernetes_io/issued-credential-id with subsequent API activity.

Immediate actions

Enable EKS control-plane audit logging and integrate with SIEM

Cloud Security 48h

Deploy the TokenRequest API detection rule to production

Detection Engineering 72h

Threat Hunt

Analyze EKS audit logs for 'create' verb on 'serviceaccounts/token' by unexpected users

T1552.007 high high confidence hunt now

Data: aws.eks.audit logs

Detection coverage 2

Detect Suspicious TokenRequest API Creation

medium

Detects the creation of a Kubernetes service account token via the TokenRequest API by a non-system identity, which may indicate credential theft or privilege escalation.

sigma tactics: credential_access techniques: T1552.007 sources: webserver, kubernetes

Detect Authorized Anonymous Requests to EKS API

medium

Detects authorized requests from system:anonymous or system:unauthenticated users with unusual user agents, excluding standard health check endpoints.

sigma tactics: initial_access techniques: T1078.001 sources: webserver, kubernetes

Detection queries are available on the platform. Get full rules →