aws-eks-access-entry-cluster-admin-config-control

CreateAccessEntry + AssociateAccessPolicy with AmazonEKSClusterAdminPolicy also grants the principal ability to modify cluster access configuration, enabling chaining to downstream cluster-auth-mode control paths.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`KubernetesCluster`
source	`?principal`
target	`?cluster`
permissions	`eks:CreateAccessEntry` `eks:AssociateAccessPolicy`
conditions	`iam_permission` `condition_expression` `scp_or_org_policy`
state logic	ACTIVE if both eks:CreateAccessEntry and eks:AssociateAccessPolicy are present at cluster scope (same gate as CanGrantPermission above). CONDITIONAL(iam_permission) if either action is missing or scoped narrowly. BLOCKED if an SCP or permission boundary denies either action.

source type

Identity

target type

KubernetesCluster

source

?principal

target

?cluster

permissions

eks:CreateAccessEntry eks:AssociateAccessPolicy

conditions

iam_permission condition_expression scp_or_org_policy

state logic

ACTIVE if both eks:CreateAccessEntry and eks:AssociateAccessPolicy are present at cluster scope (same gate as CanGrantPermission above). CONDITIONAL(iam_permission) if either action is missing or scoped narrowly. BLOCKED if an SCP or permission boundary denies either action.

Narrative

{principal.name} can modify cluster {cluster.name}'s access configuration via eks:CreateAccessEntry and eks:AssociateAccessPolicy, controlling which IAM principals receive cluster-admin access.

Raw rule rules/derived/aws/eks.yaml

id: aws-eks-access-entry-cluster-admin-config-control
emits: CanModifyConfiguration
description: CreateAccessEntry + AssociateAccessPolicy with AmazonEKSClusterAdminPolicy also grants the
  principal ability to modify cluster access configuration, enabling chaining to downstream cluster-auth-mode
  control paths.
match:
- - principal: null
  - HasPermission
  - cluster: null
where:
- ?principal has EFFECTIVE eks:CreateAccessEntry on ?cluster
- ?principal has EFFECTIVE eks:AssociateAccessPolicy on ?cluster
- ?principal can associate policyArn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy
  with accessScope.type=cluster
- node_type(?cluster) == KubernetesCluster
emit:
  source_type: Identity
  target_type: KubernetesCluster
  source: ?principal
  target: ?cluster
  permissions:
  - eks:CreateAccessEntry
  - eks:AssociateAccessPolicy
  conditions:
  - iam_permission
  - condition_expression
  - scp_or_org_policy
  state_logic: ACTIVE if both eks:CreateAccessEntry and eks:AssociateAccessPolicy are present at cluster
    scope (same gate as CanGrantPermission above). CONDITIONAL(iam_permission) if either action is missing
    or scoped narrowly. BLOCKED if an SCP or permission boundary denies either action.
  confidence: 0.95
  derived_from:
  - eks:CreateAccessEntry effective permission on ?cluster
  - eks:AssociateAccessPolicy effective permission on ?cluster with AmazonEKSClusterAdminPolicy
  false_positive_note: This emit models the configuration control aspect of cluster-admin access (ability
    to manage access entries), separate from the CanGrantPermission to a receiving IAM principal. Both
    are aspects of the same capability.
  narrative: '{principal.name} can modify cluster {cluster.name}''s access configuration via eks:CreateAccessEntry
    and eks:AssociateAccessPolicy, controlling which IAM principals receive cluster-admin access.'