AWS EKS Access Entry Granted Cluster Admin Policy

  1[metadata]
  2creation_date = "2026/05/06"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS
 11Access Entries API. This grants full cluster-admin equivalent access to the specified IAM user or role. Unlike the
 12legacy aws-auth ConfigMap which is only visible in Kubernetes audit logs, Access Entries modifications appear in
 13CloudTrail, providing an additional detection surface. Attackers who have obtained IAM permissions to manage EKS
 14access entries can use this API to backdoor cluster access for persistence, mapping attacker-controlled IAM
 15identities to cluster-admin privileges without modifying any Kubernetes resources.
 16"""
 17false_positives = [
 18    """
 19    Platform or security teams may legitimately associate these policies during cluster onboarding, break-glass admin
 20    setup, or controlled RBAC migrations from aws-auth. Validate the caller, change ticket, and target IAM principal.
 21    """,
 22]
 23from = "now-6m"
 24index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS EKS Access Entry Granted Cluster Admin Policy"
 28note = """## Triage and analysis
 29
 30### Investigating AWS EKS Access Entry Granted Cluster Admin Policy
 31
 32Successful AssociateAccessPolicy with AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy binds highly privileged
 33Kubernetes access to an IAM principal. Review who invoked the API (user.name, aws.cloudtrail.user_identity fields),
 34source.ip, user_agent.original, cloud.account.id, and cloud.region.
 35
 36### Possible investigation steps
 37
 38- Parse aws.cloudtrail.request_parameters and response elements for cluster name, access entry ARN, and policy ARN.
 39- Confirm whether the IAM principal receiving the policy is expected to have cluster-admin-class access.
 40- Correlate with other EKS API calls (CreateAccessEntry, UpdateAccessEntry) and with Kubernetes audit activity from
 41  newly authorized principals.
 42- Compare against change records for migrations from aws-auth or new administrator onboarding.
 43
 44### Response and remediation
 45
 46- If unauthorized, disassociate the policy or remove the access entry per AWS guidance; audit who can call eks:*
 47  APIs in IAM.
 48- Rotate credentials for any suspected compromised IAM principal; review organizational SCPs and cluster auth mode.
 49
 50### Additional information
 51
 52- [Amazon EKS access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html)
 53- [AssociateAccessPolicy](https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateAccessPolicy.html)
 54"""
 55references = [
 56    "https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html",
 57    "https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateAccessPolicy.html",
 58]
 59risk_score = 73
 60rule_id = "9550ec87-e73c-4baa-ad44-e448a33fbc3d"
 61severity = "high"
 62tags = [
 63    "Domain: Cloud",
 64    "Domain: Kubernetes",
 65    "Data Source: AWS",
 66    "Data Source: Amazon Web Services",
 67    "Data Source: AWS CloudTrail",
 68    "Use Case: Threat Detection",
 69    "Tactic: Privilege Escalation",
 70    "Tactic: Persistence",
 71    "Resources: Investigation Guide",
 72    "Noise: Low",
 73    "Performance: Normal",
 74    "Rule Type: Custom Query (KQL)",
 75    "Platform: AWS",
 76    "Domain: Containers",
 77    "Service: AWS EKS",
 78]
 79timestamp_override = "event.ingested"
 80type = "query"
 81query = '''
 82data_stream.dataset:"aws.cloudtrail" and
 83event.provider:"eks.amazonaws.com" and
 84event.action:"AssociateAccessPolicy" and
 85event.outcome:"success" and
 86aws.cloudtrail.request_parameters:(*AmazonEKSClusterAdminPolicy* or *AmazonEKSAdminPolicy*)
 87'''
 88
 89[rule.investigation_fields]
 90field_names = [
 91    "@timestamp",
 92    "user.name",
 93    "user_agent.original",
 94    "source.ip",
 95    "aws.cloudtrail.user_identity.arn",
 96    "aws.cloudtrail.user_identity.type",
 97    "event.action",
 98    "event.outcome",
 99    "cloud.account.id",
100    "cloud.region",
101    "aws.cloudtrail.request_parameters",
102    "aws.cloudtrail.response_elements",
103]
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107
108[[rule.threat.technique]]
109id = "T1098"
110name = "Account Manipulation"
111reference = "https://attack.mitre.org/techniques/T1098/"
112
113[[rule.threat.technique.subtechnique]]
114id = "T1098.006"
115name = "Additional Container Cluster Roles"
116reference = "https://attack.mitre.org/techniques/T1098/006/"
117
118[rule.threat.tactic]
119id = "TA0004"
120name = "Privilege Escalation"
121reference = "https://attack.mitre.org/tactics/TA0004/"
122
123[[rule.threat]]
124framework = "MITRE ATT&CK"
125
126[[rule.threat.technique]]
127id = "T1098"
128name = "Account Manipulation"
129reference = "https://attack.mitre.org/techniques/T1098/"
130
131[[rule.threat.technique.subtechnique]]
132id = "T1098.006"
133name = "Additional Container Cluster Roles"
134reference = "https://attack.mitre.org/techniques/T1098/006/"
135
136[rule.threat.tactic]
137id = "TA0003"
138name = "Persistence"
139reference = "https://attack.mitre.org/tactics/TA0003/"