AWS EKS Access Entry Created Then Deleted by Same Identity

Last updated 13 days ago on 2026-08-14

Created 13 days ago on 2026-08-14

About

Detects the creation of an Amazon EKS access entry followed by its deletion by the same identity within a short time window. EKS access entries define Kubernetes RBAC-level permissions for IAM principals in an EKS cluster. An adversary with EKS administrative access may temporarily grant themselves cluster access, use those permissions to create Kubernetes RBAC resources (ClusterRoleBindings, ServiceAccounts with privileged roles), and then delete the access entry to hide the evidence of the initial grant while retaining access through the Kubernetes-level backdoor.

Tags

Domain: CloudDomain: KubernetesPlatform: AWSPlatform: KubernetesData Source: AWS CloudTrailService: AWS EKSRule Type: Event Correlation (EQL)Tactic: PersistenceLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples

Automated infrastructure tests that create and immediately tear down EKS access entries as part of CI/CD validation may trigger this rule. Validate that the sequence corresponds to a documented test pipeline.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗sequence by aws.cloudtrail.user_identity.arn with maxspan=5m
  [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null]
  [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null]

Install detection rules in Elastic Security

Detect AWS EKS Access Entry Created Then Deleted by Same Identity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).