Comparing EKS IAM Access Methods

Comparing EKS IAM Access Methods An architecture diagram generated by Archify. IAM users · roles · AWS account · Architecture component IAM users · roles AWS account EKS access entry · Recommended · Architecture component EKS access entry Recommended aws-auth ConfigMap · Legacy · Architecture component aws-auth ConfigMap Legacy Kubernetes API · Auth · Architecture component Kubernetes API Auth EKS cluster · Resource access · Architecture component EKS cluster Resource access new path legacy path subject mapping serves requests Legend Backend Cloud Security

EKS access entry

  • • Managed through a native AWS API, so CloudTrail auditing and IaC come easily
  • • Access policies grant admin, edit, or view levels directly
  • • Works with authenticationMode set to API or API_AND_CONFIG_MAP

Limits of the aws-auth ConfigMap

  • • It is hand-edited, so one YAML mistake can lock everyone out
  • • The ConfigMap size limit makes many principals hard to manage
  • • It is not an AWS API surface, so changes are hard to trace

Migration stance

  • • Start new clusters in API mode with access entries only
  • • Move existing clusters to API_AND_CONFIG_MAP, then migrate to entries gradually
  • • Once migrated, remove the aws-auth entries and pin the cluster to API mode