The clickbait title is undermines the seriousness of this issue. In case it wasn’t explained clearly in this blog post, the IAM role that creates an EKS cluste

The clickbait title is undermines the seriousness of this issue. In case it wasn’t explained clearly in this blog post, the IAM role that creates an EKS cluster becomes sort of the “principal” of the cluster and has default system:masters privileges. These permissions are typically handled by the aws-auth configmap, but for this initial creator of the cluster, as the article explains, is not added to this map but retains system:master permissions anyway. So making this CDK role tied to this invisible permission is quite a big deal. As a best practice in my cluster creation automation I typically add the role that created the cluster to the aws-auth configmap right away. However, due to this bug, any clusters created with the flaw described in the article will pretty much need to be recreated from scratch, as I am not aware of a way to remove this invisible permission from EKS. It’s one of the “features” of EKS I’ve always hated the most. I can’t believe no one noticed this in nearly 3 years.