Description

Amazon EKS uses IAM to provide authentication to your Kubernetes cluster, but it still relies on native Kubernetes Role Based Access Control (RBAC) for authorization. This means that an AWS IAM entity can get authorized to communicate with the API server. Orca has detected that the IAM role {AwsIamRole} is connected to the K8s role {AwsIamRole.K8sRoles} that allows impersonation of other K8s roles in {AwsIamRole.K8sRoles.Namespace} namespace. An attacker with access to the AWS IAM role can impersonate to a different K8s role thus elevating their privileges in the cluster.