aws-eks-authcm-write-cluster-admin

Kubernetes write access to the aws-auth ConfigMap in kube-system (obtained after gaining any cluster access) allows adding any IAM ARN to the mapRoles/mapUsers entries with groups: [system:masters], granting cluster-admin to arbitrary IAM principals. This is the legacy (CONFIG_MAP authMode) escalation vector.

derived aws emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'any_pod': None}

where

?principal gained cluster access (kubectl) allowing kubectl apply/patch on ConfigMap aws-auth in kube-system cluster authenticationMode is CONFIG_MAP or API_AND_CONFIG_MAP ?principal has k8s RBAC that includes configmaps write in kube-system namespace

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`<any IAM principal mapped to system:masters in aws-auth ConfigMap>`
conditions	`service_state`
state logic	ACTIVE when the cluster authenticationMode is CONFIG_MAP or API_AND_CONFIG_MAP AND the principal has Kubernetes RBAC verbs [create, update, patch] on configmaps in kube-system namespace (obtained via cluster-admin or explicit kube-system configmaps write). BLOCKED when authenticationMode=API (the ConfigMap is ignored in pure API mode). CONDITIONAL(service_state) when authenticationMode is unknown. This is a Kubernetes RBAC grant, not an IAM action; the capability follows post-authentication from obtaining kubectl access to the cluster.

Narrative

{principal.name} has kubectl access to cluster {cluster.name} (authenticationMode: CONFIG_MAP or API_AND_CONFIG_MAP) with Kubernetes RBAC write permission on the aws-auth ConfigMap in kube-system (verbs: create/update/patch on configmaps). It can add any IAM ARN to mapRoles/mapUsers with groups: [system:masters], instantly granting that principal Kubernetes cluster-admin without any EKS API call.

Raw rule rules/derived/aws/eks.yaml

id: aws-eks-authcm-write-cluster-admin
emits: CanGrantPermission
description: 'Kubernetes write access to the aws-auth ConfigMap in kube-system (obtained after gaining
  any cluster access) allows adding any IAM ARN to the mapRoles/mapUsers entries with groups: [system:masters],
  granting cluster-admin to arbitrary IAM principals. This is the legacy (CONFIG_MAP authMode) escalation
  vector.'
match:
- - principal: null
  - CanExecuteCommand
  - any_pod: null
where:
- ?principal gained cluster access (kubectl) allowing kubectl apply/patch on ConfigMap aws-auth in kube-system
- cluster authenticationMode is CONFIG_MAP or API_AND_CONFIG_MAP
- ?principal has k8s RBAC that includes configmaps write in kube-system namespace
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: <any IAM principal mapped to system:masters in aws-auth ConfigMap>
  permissions: []
  k8s_rbac_verbs:
  - create
  - update
  - patch
  k8s_rbac_resources:
  - configmaps
  k8s_rbac_scope: kube-system namespace
  conditions:
  - service_state
  state_logic: ACTIVE when the cluster authenticationMode is CONFIG_MAP or API_AND_CONFIG_MAP AND the
    principal has Kubernetes RBAC verbs [create, update, patch] on configmaps in kube-system namespace
    (obtained via cluster-admin or explicit kube-system configmaps write). BLOCKED when authenticationMode=API
    (the ConfigMap is ignored in pure API mode). CONDITIONAL(service_state) when authenticationMode is
    unknown. This is a Kubernetes RBAC grant, not an IAM action; the capability follows post-authentication
    from obtaining kubectl access to the cluster.
  confidence: 0.9
  derived_from:
  - ?principal CanExecuteCommand on cluster (kubectl access)
  - '?principal k8s RBAC: configmaps {create,update,patch} in kube-system'
  - cluster authenticationMode in {CONFIG_MAP, API_AND_CONFIG_MAP}
  false_positive_note: "Only relevant when cluster authenticationMode is CONFIG_MAP or API_AND_CONFIG_MAP.\
    \ Pure API mode (authenticationMode=API) makes this BLOCKED \u2014 the aws-auth ConfigMap is ignored.\
    \ The write is a Kubernetes RBAC capability (verbs create/update/patch on configmaps in kube-system),\
    \ not an IAM action. Cluster-admin role has this implicitly, but a lower-privilege binding may not.\
    \ Do not emit if the principal does not have kubectl access or the requisite Kubernetes RBAC configmaps\
    \ write."
  narrative: '{principal.name} has kubectl access to cluster {cluster.name} (authenticationMode: CONFIG_MAP
    or API_AND_CONFIG_MAP) with Kubernetes RBAC write permission on the aws-auth ConfigMap in kube-system
    (verbs: create/update/patch on configmaps). It can add any IAM ARN to mapRoles/mapUsers with groups:
    [system:masters], instantly granting that principal Kubernetes cluster-admin without any EKS API call.'