Access entries replace the aws-auth ConfigMap for people, and Pod Identity replaces IRSA's OIDC plumbing for pods. What each does, what migrates automatically (only the cluster creator), the limits (5,000 Pod Identity associations, no Fargate or Windows), and a migration order that doesn't lock anyone out.
An access entry associates an IAM principal with Kubernetes permissions, through EKS's own API rather than a ConfigMap inside the cluster. AWS calls access entries the best way to grant users access to the Kubernetes API. Permissions come from AWS-managed access policies or from Kubernetes groups you bind with RBAC.
Managed in the EKS API, so CloudFormation, Terraform and CDK define access at cluster creation.
Recoverable: a broken grant can be fixed through the EKS API without access to the Kubernetes API, which a mistyped aws-auth entry never allowed.
Audited in CloudTrail, with IAM features such as MFA behind them.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Switch the authentication mode to API_AND_CONFIG_MAP, so both work.
Create an access entry for every role in aws-auth, with the narrowest access policy that fits.
Test each role with kubectl auth can-i; then remove its aws-auth line.
When aws-auth is empty, switch to API only.
For pods, install the Pod Identity Agent (Auto Mode includes it), create associations, and move one service at a time from IRSA annotations to Pod Identity; keep IRSA for Fargate pods.
Restrict IMDS on nodes, so pods can't fall back to the node's role.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS Network Policies With the VPC CNI: Default Deny, Admin Policies, and the Limits to Know
The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.
Read
EKS Multi-Tenancy: Namespaces, Node Pools or a Cluster per Tenant
Three levels of isolation for teams or customers sharing EKS: namespaces with quotas and network policies, dedicated node pools, or a cluster each. What each actually isolates (containers share a kernel), what it costs (from nothing to $73 a month per cluster plus duplicated add-ons), and how to choose per tenant rather than per platform.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.