EKS Modification – Workload Integrity Degradation

AWS Specific Content A prerequisite for this technique is that a threat actor has already gained access to a running container within an Amazon EKS cluster and has obtained Kubernetes API credentials with permissions to modify cluster configuration resources. Threat actors may modify internal EKS cluster configuration, such as mutating admission webhooks, init containers in pod templates, or ConfigMaps, so that newly created pods are compromised at startup. This establishes persistence that survives individual container restarts and allows the threat actor to move laterally across namespaces as new workloads are deployed. In multi-tenant EKS environments, this technique enables the threat actor to compromise workloads belonging to other tenants within the same cluster.