---
title: EKS clusters should use dedicated Kubernetes service accounts for workloads
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EKS clusters should use dedicated
  Kubernetes service accounts for workloads
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EKS clusters should use dedicated Kubernetes service accounts for workloads
 
## Description{% #description %}

EKS clusters should run workloads with dedicated Kubernetes service accounts that are associated to least-privilege IAM roles through EKS Pod Identity or IRSA, instead of sharing the namespace default service account across unrelated workloads. This rule checks that a cluster has at least one EKS Pod Identity association bound to a dedicated, non-default Kubernetes service account. IRSA-based associations created through the cluster OIDC provider are not represented by the available resource fields, so those clusters may require manual verification.

## Remediation{% #remediation %}

Create a dedicated Kubernetes service account for each application or distinct AWS permission boundary and associate it with a least-privilege IAM role, then update workload manifests to set `spec.serviceAccountName` explicitly so the namespace default service account is not used. Prefer EKS Pod Identity where supported, as described in [Attach an IAM role to a Kubernetes service account with EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).

## References{% #references %}

- [Amazon EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)
- [IAM roles for service accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)