---
title: >-
  EKS clusters should use access entries to manage IAM principal access to
  Kubernetes
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EKS clusters should use access entries
  to manage IAM principal access to Kubernetes
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EKS clusters should use access entries to manage IAM principal access to Kubernetes
 
## Description{% #description %}

EKS clusters should set the cluster authentication mode to `API` or `API_AND_CONFIG_MAP` so IAM principal access to the Kubernetes API can be managed centrally through EKS access entries instead of the deprecated `aws-auth` ConfigMap. Access entries are only available when the authentication mode includes the EKS API, providing a cleaner and auditable model for granting and revoking access.

## Remediation{% #remediation %}

Update the cluster authentication mode to include the EKS API, then create and scope access entries for each IAM principal that needs Kubernetes access. See [Grant IAM users and roles access to Kubernetes APIs](https://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html) for configuring access entries.

## References{% #references %}

- [Grant IAM users and roles access to Kubernetes APIs](https://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html)
- [Manage access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)