create configmaps
If a sensitive kube-system ConfigMap does not exist yet, create alone adds one from scratch with attacker-controlled content, no update or patch needed.
Contextual upgrade to T0:
On EKS clusters where the aws-auth ConfigMap does not yet exist (self-managed or fresh), creating it maps an attacker IAM principal to system:masters for cluster-admin.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
This is EKS-specific and requires the cluster's authentication mode to be CONFIG_MAP or API_AND_CONFIG_MAP.
A cluster fully migrated to API mode ignores this ConfigMap entirely.
If aws-auth doesn't exist yet (self-managed clusters, or a fresh EKS cluster before it's applied), create it directly instead of patching.
Patch or create the aws-auth ConfigMap in kube-system, mapping your AWS IAM ARN to the system:masters group
Authenticate via AWS CLI as cluster-admin
Additional rights needed:
Note:
AWS now calls aws-auth deprecated in favor of EKS access entries.
Auth mode moves CONFIG_MAP -> API_AND_CONFIG_MAP -> API only, and never moves back.
Once on API mode, aws-auth is permanently inert.
Update the CoreDNS ConfigMap in kube-system to add a rewrite rule or a stub zone.
CoreDNS reloads its configuration within seconds without a restart.
Every pod in the cluster then resolves the targeted name to an address of your choosing.
Whether that yields credentials depends on the client.
It needs a listener on the redirected address and a client that does not verify the server certificate against the name it asked for.
Additional rights needed: