---
title: >-
  EKS Pod Identity associations should not bind AWS permissions to the default
  service account
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EKS Pod Identity associations should
  not bind AWS permissions to the default service account
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EKS Pod Identity associations should not bind AWS permissions to the default service account
 
## Description{% #description %}

EKS Pod Identity associations should bind AWS permissions to dedicated, explicitly named Kubernetes service accounts rather than the namespace `default` service account. Sharing the default service account across unrelated workloads weakens least privilege, increases blast radius, and reduces audit clarity when a Pod is compromised. This check evaluates Pod Identity associations only; Kubernetes workload manifests and token auto-mounting settings are not visible through the available resource schema.

## Remediation{% #remediation %}

Create a dedicated service account for each workload and update the EKS Pod Identity association to reference it instead of `default`. See [Amazon EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).

## References{% #references %}

- [Amazon EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)
- [Configure Service Accounts for Pods](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)