Amazon EKS — EKS Access Entries

EKS Access Entries are a new API-driven approach to manage cluster access, replacing the aws-auth ConfigMap. They provide centralized, auditable access control managed entirely through the EKS API.

---

Authentication Modes

Mode	Description	Recommended
CONFIG_MAP	Legacy aws-auth only	No
API	Access entries only	For new clusters
API_AND_CONFIG_MAP	Both supported	For migration

Set Auth Mode

aws eks update-cluster-config \
  --name my-cluster \
  --access-config authenticationMode=API_AND_CONFIG_MAP

---

Creating Access Entries

Admin Access

aws eks create-access-entry \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/PlatformAdminRole \
  --type STANDARD

aws eks associate-access-policy \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/PlatformAdminRole \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \
  --access-scope type=cluster

Namespace-Scoped Access

aws eks create-access-entry \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/DevTeamRole \
  --type STANDARD

aws eks associate-access-policy \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/DevTeamRole \
  --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminViewPolicy \
  --access-scope type=namespace,namespaces=production,staging

---

EKS Access Policies

Policy	Scope	Permissions
AmazonEKSClusterAdminPolicy	Cluster	Full cluster admin (equivalent to system:masters)
AmazonEKSAdminPolicy	Namespace	Full admin within namespaces
AmazonEKSEditPolicy	Namespace	Create/update/delete resources
AmazonEKSViewPolicy	Namespace	Read-only access
AmazonEKSAdminViewPolicy	Cluster	Read-only across entire cluster

---

Access Entry with Kubernetes Groups

Map IAM principals to K8s groups for custom RBAC:

aws eks create-access-entry \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/QATeamRole \
  --type STANDARD \
  --kubernetes-groups '["qa-group"]'

Then create RBAC bindings for qa-group:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: qa-team-access
  namespace: qa
subjects:
  - kind: Group
    name: qa-group
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: qa-role
  apiGroup: rbac.authorization.k8s.io

---

Access Entries vs aws-auth

Feature	aws-auth ConfigMap	Access Entries
Management	kubectl / YAML	AWS API / CLI / Terraform
Audit	Limited	Full CloudTrail audit
Risk	ConfigMap corruption can lock out cluster	API-managed, no K8s-level risk
Predefined policies	No	Yes (5 policies)
Namespace scoping	Via RBAC only	Native scope parameter
IaC support	kubectl/Helm	Terraform, CloudFormation

---

Terraform

resource "aws_eks_access_entry" "dev_team" {
  cluster_name  = module.eks.cluster_name
  principal_arn = aws_iam_role.dev_team.arn
  type          = "STANDARD"
}

resource "aws_eks_access_policy_association" "dev_team_edit" {
  cluster_name  = module.eks.cluster_name
  principal_arn = aws_iam_role.dev_team.arn
  policy_arn    = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEditPolicy"

  access_scope {
    type       = "namespace"
    namespaces = ["production", "staging"]
  }
}

---

Migration from aws-auth

1. Switch authentication mode to API_AND_CONFIG_MAP
2. Create access entries for all IAM principals currently in aws-auth
3. Test access with each principal
4. Once validated, switch to API mode
5. The aws-auth ConfigMap is ignored in API mode

# List current access entries
aws eks list-access-entries --cluster-name my-cluster

# Describe a specific entry
aws eks describe-access-entry \
  --cluster-name my-cluster \
  --principal-arn arn:aws:iam::123456789:role/DevTeamRole

---

Best Practices

1. Use access entries for all new clusters — skip aws-auth entirely
2. Use predefined policies when possible — simpler than custom RBAC
3. Scope access to namespaces — avoid cluster-wide admin for teams
4. Map IAM roles, not users — roles are reusable and scalable
5. Audit with CloudTrail — every access entry change is logged

---