aws-eks-update-cluster-config-access
eks:UpdateClusterConfig allows changing the cluster's authenticationMode, endpoint access settings (public/private), and upgrade policy. An attacker with this permission can enable API authenticationMode to allow access entry creation, or change endpoint access to make the API server reachable, enabling follow-on access entry cluster-admin escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE eks:UpdateClusterConfig on ?cluster
node_type(?cluster) ==
KubernetesCluster
emit
| source type | Identity |
|---|---|
| target type | KubernetesCluster |
| source | ?principal |
| target | ?cluster |
| permissions | eks:UpdateClusterConfig |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE if eks:UpdateClusterConfig is in scope for the cluster. The attack value is highest when combined with eks:CreateAccessEntry + eks:AssociateAccessPolicy: UpdateClusterConfig can switch authenticationMode to API or API_AND_CONFIG_MAP (enabling the access entry API if it was previously set to CONFIG_MAP-only), then the access-entry cluster-admin path fires. CONDITIONAL(iam_permission) if UpdateClusterConfig is missing. BLOCKED if an SCP denies eks:UpdateClusterConfig. |
Narrative
{principal.name} holds eks:UpdateClusterConfig on cluster {cluster.name}. It can change the authenticationMode (enabling access entry API if previously CONFIG_MAP-only), or toggle endpoint public/private access, enabling follow-on access-entry cluster-admin escalation or expanding the network attack surface.
Raw rule rules/derived/aws/eks.yaml
id: aws-eks-update-cluster-config-access
emits: CanModifyConfiguration
description: eks:UpdateClusterConfig allows changing the cluster's authenticationMode, endpoint access
settings (public/private), and upgrade policy. An attacker with this permission can enable API authenticationMode
to allow access entry creation, or change endpoint access to make the API server reachable, enabling
follow-on access entry cluster-admin escalation.
match:
- - principal: null
- HasPermission
- cluster: null
where:
- ?principal has EFFECTIVE eks:UpdateClusterConfig on ?cluster
- node_type(?cluster) == KubernetesCluster
emit:
source_type: Identity
target_type: KubernetesCluster
source: ?principal
target: ?cluster
permissions:
- eks:UpdateClusterConfig
conditions:
- iam_permission
- scp_or_org_policy
state_logic: 'ACTIVE if eks:UpdateClusterConfig is in scope for the cluster. The attack value is highest
when combined with eks:CreateAccessEntry + eks:AssociateAccessPolicy: UpdateClusterConfig can switch
authenticationMode to API or API_AND_CONFIG_MAP (enabling the access entry API if it was previously
set to CONFIG_MAP-only), then the access-entry cluster-admin path fires. CONDITIONAL(iam_permission)
if UpdateClusterConfig is missing. BLOCKED if an SCP denies eks:UpdateClusterConfig.'
confidence: 0.85
derived_from:
- eks:UpdateClusterConfig effective permission on ?cluster
false_positive_note: 'eks:UpdateClusterConfig alone does not grant cluster-admin; it is a CanModifyConfiguration
fact that feeds downstream access-entry creation (aws-eks-access-entry-cluster-admin). Note: AWS authenticationMode
migration is one-directional: from CONFIG_MAP to API or API_AND_CONFIG_MAP is permanent (cannot revert
to CONFIG_MAP-only). The attack value is switching FROM CONFIG_MAP to API/API_AND_CONFIG_MAP to enable
access entries. Honor SCP denial. Also: changing endpointPublicAccess from false to true expands the
network attack surface (feeds ExposedToInternet derivation).'
narrative: '{principal.name} holds eks:UpdateClusterConfig on cluster {cluster.name}. It can change
the authenticationMode (enabling access entry API if previously CONFIG_MAP-only), or toggle endpoint
public/private access, enabling follow-on access-entry cluster-admin escalation or expanding the network
attack surface.'