Impact

Successful abuse of EKS Access Entries can allow an attacker to gain persistent, unauthorized access to a Kubernetes cluster, potentially leading to unauthorized data access, lateral movement, or service disruption. Monitoring for these changes helps identify unauthorized privilege escalation or persistence efforts before they are leveraged for further malicious activity.

Recommendation

• Implement monitoring for the specific CloudTrail actions listed in the Sigma rule below to detect unauthorized cluster access changes.
• Review and baseline existing IAM roles utilized by deployment pipelines (e.g., terraform, eksctl) to reduce false positives in detection logic.
• Pair these alerts with Kubernetes audit log monitoring to track subsequent API activity performed by identities tied to newly created or updated access entries.
• Use AWS IAM and Service Control Policies (SCPs) to restrict access to EKS configuration APIs to authorized administrators only.