✄𐘗
text code block:
✄𐘗data_stream.dataset:"aws.eks_audit" and aws.eks.audit.annotations.authorization_k8s_io/decision:"allow" and
(
  aws.eks.audit.user.username:(
    system\:serviceaccount\:* and not (
      "system:serviceaccount:kube-system:clusterrole-aggregation-controller" or
      "system:serviceaccount:kube-system:generic-garbage-collector"
    )
  ) or
  aws.eks.audit.impersonatedUser.username:(
    system\:serviceaccount\:* and not (
      "system:serviceaccount:kube-system:clusterrole-aggregation-controller" or
      "system:serviceaccount:kube-system:generic-garbage-collector"
    )
  )
) and
aws.eks.audit.objectRef.resource:("clusterrolebindings" or "clusterroles" or "rolebindings" or "roles") and
aws.eks.audit.verb:("create" or "delete" or "patch" or "update")