aws-eks-access-entry-cluster-admin

CreateAccessEntry + AssociateAccessPolicy with AmazonEKSClusterAdminPolicy maps an IAM principal to Kubernetes cluster-admin (system:masters) RBAC. The principal can then exec into any pod and execute as its IAM role.

derived aws emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'cluster': None}

where

?principal has EFFECTIVE eks:CreateAccessEntry on ?cluster ?principal has EFFECTIVE eks:AssociateAccessPolicy on ?cluster ?principal can associate policyArn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy with accessScope.type=cluster node_type(?cluster) == KubernetesCluster

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`<IAM principal (self or chosen ARN) that receives cluster-admin via access entry>`
permissions	`eks:CreateAccessEntry` `eks:AssociateAccessPolicy`
conditions	`iam_permission` `condition_expression` `scp_or_org_policy`
state logic	ACTIVE if the principal has both eks:CreateAccessEntry and eks:AssociateAccessPolicy at the cluster scope AND the AmazonEKSClusterAdminPolicy association scope is cluster-wide (accessScope.type=cluster). CONDITIONAL(iam_permission) if either action is missing or scoped only to specific namespaces (AmazonEKSAdminPolicy namespace-scoped is weaker — do not emit cluster-admin for namespace-scoped associations). BLOCKED if an SCP or permission boundary denies eks:CreateAccessEntry or eks:AssociateAccessPolicy.

Narrative

{principal.name} holds eks:CreateAccessEntry and eks:AssociateAccessPolicy on cluster {cluster.name}. It can create an access entry for any IAM ARN and associate AmazonEKSClusterAdminPolicy (scope: cluster), granting that ARN Kubernetes cluster-admin (system:masters) RBAC - equivalent to unrestricted kubectl access across all namespaces.

Raw rule rules/derived/aws/eks.yaml

id: aws-eks-access-entry-cluster-admin
emits: CanGrantPermission
description: CreateAccessEntry + AssociateAccessPolicy with AmazonEKSClusterAdminPolicy maps an IAM principal
  to Kubernetes cluster-admin (system:masters) RBAC. The principal can then exec into any pod and execute
  as its IAM role.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- ?principal has EFFECTIVE eks:CreateAccessEntry on ?cluster
- ?principal has EFFECTIVE eks:AssociateAccessPolicy on ?cluster
- ?principal can associate policyArn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy
  with accessScope.type=cluster
- node_type(?cluster) == KubernetesCluster
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: <IAM principal (self or chosen ARN) that receives cluster-admin via access entry>
  permissions:
  - eks:CreateAccessEntry
  - eks:AssociateAccessPolicy
  conditions:
  - iam_permission
  - condition_expression
  - scp_or_org_policy
  state_logic: "ACTIVE if the principal has both eks:CreateAccessEntry and eks:AssociateAccessPolicy at\
    \ the cluster scope AND the AmazonEKSClusterAdminPolicy association scope is cluster-wide (accessScope.type=cluster).\
    \ CONDITIONAL(iam_permission) if either action is missing or scoped only to specific namespaces (AmazonEKSAdminPolicy\
    \ namespace-scoped is weaker \u2014 do not emit cluster-admin for namespace-scoped associations).\
    \ BLOCKED if an SCP or permission boundary denies eks:CreateAccessEntry or eks:AssociateAccessPolicy."
  confidence: 0.95
  derived_from:
  - eks:CreateAccessEntry effective permission on ?cluster
  - eks:AssociateAccessPolicy effective permission on ?cluster with AmazonEKSClusterAdminPolicy
  false_positive_note: "Only AmazonEKSClusterAdminPolicy with accessScope.type=cluster yields full system:masters\
    \ equivalence. AmazonEKSAdminPolicy is namespace- scoped (not cluster-admin). AmazonEKSClusterAdminPolicy\
    \ with accessScope.type=namespace is limited to those namespaces \u2014 do NOT emit cluster-admin\
    \ CanGrantPermission for namespace-scoped entries. Honor SCP and permission boundary denials on eks:CreateAccessEntry\
    \ / eks:AssociateAccessPolicy. If the cluster authenticationMode=CONFIG_MAP only, access entries have\
    \ no effect \u2014 downgrade to POTENTIAL."
  narrative: "{principal.name} holds eks:CreateAccessEntry and eks:AssociateAccessPolicy on cluster {cluster.name}.\
    \ It can create an access entry for any IAM ARN and associate AmazonEKSClusterAdminPolicy (scope:\
    \ cluster), granting that ARN Kubernetes cluster-admin (system:masters) RBAC \u2014 equivalent to\
    \ unrestricted kubectl access across all namespaces."