AWS EKS Access Entry Created Then Deleted by Same Identity

  1[metadata]
  2creation_date = "2026/08/14"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the creation of an Amazon EKS access entry followed by its deletion by the same
 11identity within a short time window. EKS access entries define Kubernetes RBAC-level
 12permissions for IAM principals in an EKS cluster. An adversary with EKS administrative
 13access may temporarily grant themselves cluster access, use those permissions to create
 14Kubernetes RBAC resources (ClusterRoleBindings, ServiceAccounts with privileged roles),
 15and then delete the access entry to hide the evidence of the initial grant while retaining
 16access through the Kubernetes-level backdoor.
 17"""
 18false_positives = [
 19    """
 20    Automated infrastructure tests that create and immediately tear down EKS access entries
 21    as part of CI/CD validation may trigger this rule. Validate that the sequence corresponds
 22    to a documented test pipeline.
 23    """,
 24]
 25from = "now-15m"
 26index = ["logs-aws.cloudtrail-*"]
 27language = "eql"
 28license = "Elastic License v2"
 29name = "AWS EKS Access Entry Created Then Deleted by Same Identity"
 30note = """## Triage and analysis
 31
 32### Investigating AWS EKS Access Entry Created Then Deleted by Same Identity
 33
 34EKS access entries (introduced in EKS API mode) map IAM principals to Kubernetes access policies or allow associating Kubernetes groups to IAM principals. An adversary who obtains `eks:CreateAccessEntry` and `eks:DeleteAccessEntry` permissions can:
 35
 361. Create an access entry for their own IAM principal with cluster-admin level access.
 372. Use that access to create persistent Kubernetes RBAC resources (ClusterRoleBindings, privileged ServiceAccounts, rogue DaemonSets).
 383. Delete the access entry, removing the CloudTrail evidence of the initial grant while retaining Kubernetes-level access.
 39
 40This sequence is analogous to adding a backdoor user, using it, then deleting it to cover tracks. The deletion within a short window of creation is the key behavioral indicator.
 41
 42### Possible investigation steps
 43
 44- Identify the calling identity from `aws.cloudtrail.user_identity.arn` and the targeted cluster from `aws.cloudtrail.request_parameters`.
 45- Review Kubernetes audit logs for the affected cluster in the time window between the `CreateAccessEntry` and `DeleteAccessEntry` events. Look for `create` verbs on ClusterRoleBindings, RoleBindings, ServiceAccounts, or DaemonSets.
 46- Check the cluster's current RBAC configuration for persistent backdoor resources.
 47- Determine whether the identity had a legitimate reason to create an access entry for the targeted cluster.
 48
 49### False positive analysis
 50
 51- Infrastructure-as-code and CI/CD pipelines that create and tear down EKS access entries as part of cluster validation — Terraform or eksctl apply/destroy cycles, ephemeral test clusters — will produce this exact sequence. Correlate with the pipeline identity and change records before triaging further.
 52- Short-lived break-glass or just-in-time administrative access that is granted and revoked by the same operator within minutes is legitimate; confirm against access-request tickets or change approvals.
 53- Migration tooling that switches clusters between authentication modes may churn access entries in bulk under a single automation role.
 54- The sequence correlates on the calling identity only, so confirm the `CreateAccessEntry` and `DeleteAccessEntry` events reference the same cluster and principal ARN in the request parameters before treating them as one grant-and-revoke cycle.
 55- Scope any exceptions by the calling ARN or automation role rather than excluding the behavior globally.
 56
 57### Response and remediation
 58
 59- Audit all Kubernetes RBAC resources for unauthorized ClusterRoleBindings or privileged ServiceAccounts created in the suspect window.
 60- Rotate credentials for the calling identity.
 61- Apply IAM policies restricting `eks:CreateAccessEntry` and `eks:DeleteAccessEntry` to designated EKS administrative roles.
 62"""
 63references = [
 64    "https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAccessEntry.html",
 65    "https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteAccessEntry.html",
 66    "https://www.wiz.io/blog/new-attack-vectors-emerge-via-recent-eks-access-entries-and-pod-identity-features",
 67    "https://securitylabs.datadoghq.com/articles/eks-cluster-access-management-deep-dive/",
 68]
 69risk_score = 47
 70rule_id = "2b60fb61-d0c7-405e-9f33-a66d8729628d"
 71setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. EKS management events are logged by default."
 72severity = "medium"
 73tags = [
 74    "Domain: Cloud",
 75    "Domain: Kubernetes",
 76    "Platform: AWS",
 77    "Platform: Kubernetes",
 78    "Data Source: AWS CloudTrail",
 79    "Service: AWS EKS",
 80    "Rule Type: Event Correlation (EQL)",
 81    "Tactic: Persistence",
 82    "Resources: Investigation Guide",
 83]
 84timestamp_override = "event.ingested"
 85type = "eql"
 86
 87query = '''
 88sequence by aws.cloudtrail.user_identity.arn with maxspan=5m
 89  [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null]
 90  [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null]
 91'''
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1098"
 97name = "Account Manipulation"
 98reference = "https://attack.mitre.org/techniques/T1098/"
 99[[rule.threat.technique.subtechnique]]
100id = "T1098.006"
101name = "Additional Container Cluster Roles"
102reference = "https://attack.mitre.org/techniques/T1098/006/"
103
104[rule.threat.tactic]
105id = "TA0003"
106name = "Persistence"
107reference = "https://attack.mitre.org/tactics/TA0003/"
108
109[rule.investigation_fields]
110field_names = [
111    "@timestamp",
112    "aws.cloudtrail.user_identity.arn",
113    "aws.cloudtrail.user_identity.type",
114    "user.name",
115    "event.action",
116    "event.outcome",
117    "aws.cloudtrail.request_parameters",
118    "source.ip",
119    "cloud.region",
120    "cloud.account.id",
121]