---
title: >-
  EKS access policies should be scoped to dedicated namespaces instead of the
  default namespace
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EKS access policies should be scoped to
  dedicated namespaces instead of the default namespace
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EKS access policies should be scoped to dedicated namespaces instead of the default namespace
 
## Description{% #description %}

AWS EKS access policies should be scoped to dedicated namespaces that reflect intended team, application, or environment boundaries instead of the default namespace. Relying on the default namespace weakens administrative separation and makes namespace-scoped access control, resource governance, and network segmentation harder to apply consistently. This check evaluates EKS access policy associations and flags those that are cluster-wide or scoped to the default namespace.

## Remediation{% #remediation %}

Associate EKS access policies to specific dedicated namespaces rather than the whole cluster or the default namespace, and migrate workloads into namespaces that align with namespace-scoped Roles, RoleBindings, quotas, limits, service accounts, and network policies. For guidance, see the [EKS access policies documentation](https://docs.aws.amazon.com/eks/latest/userguide/access-policies.html).

## References{% #references %}

- [Amazon EKS multi-tenancy best practices](https://docs.aws.amazon.com/eks/latest/best-practices/tenant-isolation.html)
- [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)