AWS EKS Access Entry Modified

  1[metadata]
  2creation_date = "2026/05/06"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful Amazon EKS Access Entries API operations that create, update, attach, detach, or delete authentication
 11mappings between IAM principals and the cluster. Changes to access entries alter who can authenticate to Kubernetes and
 12what Kubernetes-level permissions they receive, without requiring edits to in-cluster RBAC objects. Unexpected callers
 13or timing may indicate persistence or privilege abuse. Common automation identities (service-linked roles, eksctl,
 14Terraform, CloudFormation role patterns) are excluded to reduce noise; tune further for your deployment pipelines.
 15"""
 16false_positives = [
 17    """
 18    Cluster provisioning, GitOps, or approved platform automation may perform these APIs under IAM principals whose ARNs do
 19    not match the exclusion patterns. Baseline expected roles and expand exclusions if needed.
 20    """,
 21]
 22from = "now-6m"
 23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS EKS Access Entry Modified"
 27note = """## Triage and analysis
 28
 29### Investigating AWS EKS Access Entry Modified
 30
 31Review aws.cloudtrail.user_identity (ARN, type), user.name, source.ip, user_agent.original, cloud.account.id, and
 32cloud.region. Map event.action to intent: new principal (CreateAccessEntry), policy binding changes (AssociateAccessPolicy,
 33DisassociateAccessPolicy), metadata updates (UpdateAccessEntry), or removal (DeleteAccessEntry).
 34
 35### Possible investigation steps
 36
 37- Inspect aws.cloudtrail.request_parameters and response_elements for cluster name, principal ARN, and policy ARNs.
 38- Compare against change management and infrastructure-as-code deploy windows.
 39- Correlate with Kubernetes audit logs for subsequent API activity from identities tied to the affected access entry.
 40- Pair with the higher-fidelity rule EKS Access Entry Granted Cluster Admin Policy when AssociateAccessPolicy fires.
 41
 42### Response and remediation
 43
 44- If unauthorized, revert access entry changes via AWS APIs or console; restrict eks:* permissions and review SCPs.
 45- Rotate credentials for compromised IAM principals as appropriate.
 46
 47### Additional information
 48
 49- [Amazon EKS access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html)
 50"""
 51references = [
 52    "https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html",
 53]
 54risk_score = 47
 55rule_id = "90c0ce77-3fb4-484f-a8ad-4648e12b35b1"
 56severity = "medium"
 57tags = [
 58    "Domain: Cloud",
 59    "Domain: Kubernetes",
 60    "Data Source: AWS",
 61    "Data Source: Amazon Web Services",
 62    "Data Source: AWS CloudTrail",
 63    "Use Case: Threat Detection",
 64    "Tactic: Persistence",
 65    "Tactic: Privilege Escalation",
 66    "Resources: Investigation Guide",
 67    "Noise: Low",
 68    "Performance: Fast",
 69    "Rule Type: Custom Query (KQL)",
 70    "Platform: AWS",
 71    "Domain: Containers",
 72    "Service: AWS EKS",
 73]
 74timestamp_override = "event.ingested"
 75type = "query"
 76query = '''
 77data_stream.dataset:"aws.cloudtrail" and event.provider:"eks.amazonaws.com" and
 78event.action:("CreateAccessEntry" or "AssociateAccessPolicy" or "UpdateAccessEntry" or "DisassociateAccessPolicy" or "DeleteAccessEntry") and
 79event.outcome:"success" and
 80not aws.cloudtrail.user_identity.arn:(*AWSServiceRoleForAmazonEKS* or *eksctl* or *terraform* or *AWSCloudFormation*)
 81'''
 82
 83[rule.investigation_fields]
 84field_names = [
 85    "@timestamp",
 86    "user.name",
 87    "user_agent.original",
 88    "source.ip",
 89    "aws.cloudtrail.user_identity.arn",
 90    "aws.cloudtrail.user_identity.type",
 91    "event.action",
 92    "event.outcome",
 93    "cloud.account.id",
 94    "cloud.region",
 95    "aws.cloudtrail.request_parameters",
 96    "aws.cloudtrail.response_elements",
 97]
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101
102[[rule.threat.technique]]
103id = "T1098"
104name = "Account Manipulation"
105reference = "https://attack.mitre.org/techniques/T1098/"
106
107[[rule.threat.technique.subtechnique]]
108id = "T1098.006"
109name = "Additional Container Cluster Roles"
110reference = "https://attack.mitre.org/techniques/T1098/006/"
111
112[rule.threat.tactic]
113id = "TA0003"
114name = "Persistence"
115reference = "https://attack.mitre.org/tactics/TA0003/"
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119
120[[rule.threat.technique]]
121id = "T1098"
122name = "Account Manipulation"
123reference = "https://attack.mitre.org/techniques/T1098/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1098.006"
127name = "Additional Container Cluster Roles"
128reference = "https://attack.mitre.org/techniques/T1098/006/"
129
130[rule.threat.tactic]
131id = "TA0004"
132name = "Privilege Escalation"
133reference = "https://attack.mitre.org/tactics/TA0004/"