VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

EKS clusters should run workloads with dedicated Kubernetes service accounts that are associated to least-privilege IAM roles through EKS Pod Identity or IRSA, instead of sharing the namespace default service account across unrelated workloads. This rule checks that a cluster has at least one EKS Pod Identity association bound to a dedicated, non-default Kubernetes service account. IRSA-based associations created through the cluster OIDC provider are not represented by the available resource fields, so those clusters may require manual verification.

Remediation

Create a dedicated Kubernetes service account for each application or distinct AWS permission boundary and associate it with a least-privilege IAM role, then update workload manifests to set spec.serviceAccountName explicitly so the namespace default service account is not used. Prefer EKS Pod Identity where supported, as described in Attach an IAM role to a Kubernetes service account with EKS Pod Identity.

References

• Amazon EKS Pod Identities
• IAM roles for service accounts (IRSA)
• CIS Amazon Web Services Benchmarks