EKS clusters should use access entries to manage IAM principal access to Kubernetes

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

EKS clusters should set the cluster authentication mode to API or API_AND_CONFIG_MAP so IAM principal access to the Kubernetes API can be managed centrally through EKS access entries instead of the deprecated aws-auth ConfigMap. Access entries are only available when the authentication mode includes the EKS API, providing a cleaner and auditable model for granting and revoking access.

Remediation

Update the cluster authentication mode to include the EKS API, then create and scope access entries for each IAM principal that needs Kubernetes access. See Grant IAM users and roles access to Kubernetes APIs for configuring access entries.

References