Wiz Analyzes Security Risks and Defenses for New Amazon EKS Identity Features

Summary

Wiz examines security implications of Amazon EKS access management and pod identity, recommending permission audits, token protections, safer service-account practices, and expanded detection using both Kubernetes and AWS CloudTrail data.

Key points

EKS access management adds access entries and policies; in API_AND_CONFIG_MAP mode, effective permissions combine grants from both mechanisms.
Auditors need EKS API access as well as Kubernetes API access to calculate principals’ effective permissions, including multiple policies attached to an entry.
A stolen pod identity token may let an attacker request credentials from the node’s pod identity agent; the article recommends reviewing RBAC, restricting hostPath access to /var/lib/kubelet, and separating workloads by risk.
Monitor access-entry creation and policy associations through AWS CloudTrail; Kubernetes admission controls and audit logs alone do not cover these events.
The article recommends monitoring for suspicious pod identity token access, role assumption, and connections to the pod identity agent.
Avoid assigning EKS pod identities to default service accounts, or disable automatic service-account token mounting where appropriate.

Article Details

Defense Focus: Detect unauthorized or high-privilege EKS access changes and pod-identity abuse, and audit effective permissions across EKS API and Kubernetes authorization paths.
Detection Methods: Monitor creation of EKS access entries and association of access policies, including grants of cluster-admin or admin access across one or multiple clusters.
Use AWS CloudTrail log-based detections for EKS access-management events; Kubernetes Admission Controller and kube-audit logs alone do not cover these events.
Detect processes using the AWS EKS CLI to discover, create, or modify pod identities, and processes using EKS pod identity to assume roles.
Alert on unrecognized access to the EKS pod-identity token and unrecognized connections to the pod-identity agent credentials endpoint.
Review policy semantics and calculate effective permissions as the union of aws-config mappings, EKS access policies, and bound Kubernetes RBAC roles.
Data Sources: AWS CloudTrail logs
Kubernetes kube-audit logs
Admission Controller events and rules
Process telemetry from Wiz sensor detections
Filesystem access to the EKS pod-identity token
Network connections to the pod-identity agent credentials endpoint
EKS API access-management events
Rule Types: Cloud log-based detections
Process behavior detections
Token-access detections
Network connection detections
Kubernetes admission rules
Platforms: Amazon EKS
Kubernetes
Defensive Actions: Audit permissions using the cluster authentication mode and include both EKS API access and aws-config mappings; account for multiple associated access policies and Kubernetes RBAC bindings.
Periodically review access-policy combinations for redundant or unintended permissions.
Treat permissions to manage EKS access entries and policies as high privilege.
Review RBAC permissions and separate workloads with different risk profiles into distinct namespaces or nodes.
Use Admission Controller rules to disallow access to /var/lib/kubelet where appropriate.
Avoid EKS pod identities on default service accounts, or disable automatic service-account-token mounting with automountServiceAccountToken: false.
Extend detection coverage to include both EKS and Kubernetes APIs.