CreateAccessEntry
AWS
CreateAccessEntry
Event
Creates an access entry for an EKS cluster, granting an IAM principal Kubernetes API access via EKS access management.
Security Context
- Account manipulation is a primary persistence technique, allowing adversaries to maintain access through modified permissions or credentials.
- Creating cloud accounts provides a durable backdoor that persists independently of any compromised user’s credentials.
Log Source
CloudTrail
Sample Event
Adversarial. Draco — having gained an admin-level role in the production account — creates an EKS access entry on the demiguise-prod cluster that grants his own IAM user (draco) the system:masters Kubernetes group binding. This bypasses any cluster-internal RBAC review process and gives him kubectl-level admin without a kubectl history he could be tied to via cluster audit logs. The targeted cluster runs DEMIGUISE inference workloads and likely has access to model weights and features.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:34:21Z", "eventSource": "eks.amazonaws.com", "eventName": "CreateAccessEntry", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "name": "demiguise-prod", "principalArn": "arn:aws:iam::555123456789:user/draco", "kubernetesGroups": [ "system:masters" ], "type": "STANDARD", "clientRequestToken": "60000000-0000-4000-8000-001010011010" }, "responseElements": { "accessEntry": { "clusterName": "demiguise-prod", "principalArn": "arn:aws:iam::555123456789:user/draco", "kubernetesGroups": [ "system:masters" ], "accessEntryArn": "arn:aws:eks:us-east-1:555123456789:access-entry/demiguise-prod/user/555123456789/draco/60000000-0000-4000-8000-001010011010", "createdAt": 1.7765234613532E9, "modifiedAt": 1.7765234613532E9, "tags": {}, "username": "arn:aws:iam::555123456789:user/draco", "type": "STANDARD" } }, "requestID": "90000000-0000-4000-8000-000001111100", "eventID": "90000000-0000-4000-8000-000001111101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "eks.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Persistence Privilege Escalation
Techniques:
- T1136.003 — Cloud Account — Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...