create configmaps
If a sensitive kube-system ConfigMap does not exist yet, create alone adds one from scratch with attacker-controlled content, no update or patch needed.
Where it already exists, create returns AlreadyExists, and kubectl apply resolves to a patch, so rewriting it needs patch or update, or delete paired with create.
Contextual upgrade to T0:
On EKS clusters where the aws-auth ConfigMap does not yet exist (self-managed or fresh), creating it maps an attacker IAM principal to system:masters for cluster-admin.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
This is EKS-specific and requires the cluster's authentication mode to be CONFIG_MAP or API_AND_CONFIG_MAP.
A cluster fully migrated to API mode ignores this ConfigMap entirely.
If aws-auth doesn't exist yet (self-managed clusters, or a fresh EKS cluster before it's applied), create it directly instead of patching.
Patch or create the aws-auth ConfigMap in kube-system, mapping your AWS IAM ARN to the system:masters group
Authenticate via AWS CLI as cluster-admin
Any IAM principal whose ARN is mapped can use it, including one from another AWS account, and it needs no AWS permissions of its own to do so
The bearer token is a locally signed GetCallerIdentity request, an API that requires no allow policy, so a zero-permission identity still authenticates
Editing the node role own entry is tempting but fails wherever that role has an access entry, since access entries override aws-auth for the same principal
Removing the mapping revokes access at once, unlike the certificate paths where an issued credential cannot be recalled
Console clusters using Auto Mode are created in API mode where this is inert, while a raw CreateCluster call with no accessConfig defaults to CONFIG_MAP where it is live
Additional rights needed:
Note:
AWS now calls aws-auth deprecated in favor of EKS access entries.
Auth mode moves CONFIG_MAP -> API_AND_CONFIG_MAP -> API only, and never moves back.
Once on API mode, aws-auth is permanently inert.