--- title: AWS deprecated this EKS auth method. 81% of clusters... description: Kubernetes security is examined through the lens of fleet-wide management, noting that AWS deprecated the aws-auth ConfigMap for EKS IAM mapping in favor of an... canonical: https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS deprecated this EKS auth method. 81% of clusters still run it. | daily.dev og:description: Kubernetes security is examined through the lens of fleet-wide management, noting that AWS deprecated the aws-auth ConfigMap for EKS IAM mapping in favor of an... og:url: https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv og:image: https://api.daily.dev/og/posts/gdqs6G7lv.png og:image:alt: AWS deprecated this EKS auth method. 81% of clusters still run it. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS deprecated this EKS auth method. 81% of clusters still run it. **[The New Stack](https://daily.dev/sources/newstack)** · 17 min read · 0 upvotes · 0 comments ## Summary Kubernetes security is examined through the lens of fleet-wide management, noting that AWS deprecated the aws-auth ConfigMap for EKS IAM mapping in favor of an API-driven alternative, yet a 2025 Kubernetes Security Report found 81% of EKS clusters still use the older method. The piece covers the 'four Cs' security framework, common cluster-fleet challenges (inconsistent policies, static secrets, multi-tenancy, image supply chain, compliance), and promotes the Nutanix Kubernetes Platform (NKP) as a fleet-level solution with hardening, Gatekeeper policy enforcement, Dex-based RBAC, Istio mTLS, and continuous compliance monitoring. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What did AWS deprecate for mapping IAM identities to EKS cluster permissions? AWS deprecated the aws-auth ConfigMap, a manually edited and hard-to-audit method for mapping IAM identities to Kubernetes RBAC permissions in EKS, in favor of a newer API-driven alternative for access control. Despite this, a 2025 Kubernetes Security Report found that 81% of EKS clusters are still running the older aws-auth ConfigMap method, contrary to AWS's own security guidance. _Teams migrating off aws-auth can track EKS access-control changes and best practices on daily.dev._ ### Why doesn't Kubernetes namespace isolation provide true multi-tenancy? Namespace-based isolation in Kubernetes only provides soft multi-tenancy because it relies on a basic trust assumption among tenants sharing a cluster; cluster-scoped resources can still be visible across namespace boundaries if RBAC permissions are misconfigured. Genuine hard multi-tenancy, where one tenant has zero visibility into another, requires dedicated clusters per tenant rather than shared namespaces. _Architects weighing namespace isolation against dedicated clusters can compare multi-tenancy approaches on daily.dev._ ### What is causing container image bloat and vulnerability risk to increase in Kubernetes environments? Image bloat has roughly quintupled and package maintenance has slipped over the past year, per Sysdig's 2025 Cloud-Native Security and Usage Report, driven partly by the rush to build with AI since AI and ML packages are much larger than traditional workloads Kubernetes was built to handle. Robust image security requires scanning at multiple stages: code sourcing, base image verification, signing, admission control, and continuous runtime scanning. _Developers hardening container image pipelines against supply-chain risk can follow related coverage on daily.dev._ ## Similar posts on daily.dev - [Mitigating IAM Template Injection in AWS EKS](https://daily.dev/posts/mitigating-iam-template-injection-in-aws-eks-y1hca3b4h) · SitePoint · 0 upvotes · 0 comments - [Amazon EKS enhances cluster governance with new IAM condition keys](https://daily.dev/posts/amazon-eks-enhances-cluster-governance-with-new-iam-condition-keys-ckr3n5yqa) · AWS · 0 upvotes · 0 comments - [Kubernetes at the edge has hit a wall. Fleet management is the way through.](https://daily.dev/posts/kubernetes-at-the-edge-has-hit-a-wall-fleet-management-is-the-way-through--rkyzk3b1z) · The New Stack · 5 upvotes · 0 comments - [AWS Announces New Amazon EKS Capabilities to Simplify Workload Orchestration](https://daily.dev/posts/aws-announces-new-amazon-eks-capabilities-to-simplify-workload-orchestration-yjjaiucnz) · InfoQ · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS deprecated this EKS auth method. 81% of clusters still run it.","url":"https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv"},"datePublished":"2026-08-19T19:01:35.185Z","dateModified":"2026-08-19T22:47:59.342Z","description":"Kubernetes security is examined through the lens of fleet-wide management, noting that AWS deprecated the aws-auth ConfigMap for EKS IAM mapping in favor of an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2aa8d3611c9aef53ca0716479d018ab2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2aa8d3611c9aef53ca0716479d018ab2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,kubernetes","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"AWS deprecated this EKS auth method. 81% of clusters still run it."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-deprecated-this-eks-auth-method-81-of-clusters-still-run-it--gdqs6g7lv#faq","mainEntity":[{"@type":"Question","name":"What did AWS deprecate for mapping IAM identities to EKS cluster permissions?","acceptedAnswer":{"@type":"Answer","text":"AWS deprecated the aws-auth ConfigMap, a manually edited and hard-to-audit method for mapping IAM identities to Kubernetes RBAC permissions in EKS, in favor of a newer API-driven alternative for access control. Despite this, a 2025 Kubernetes Security Report found that 81% of EKS clusters are still running the older aws-auth ConfigMap method, contrary to AWS's own security guidance. Teams migrating off aws-auth can track EKS access-control changes and best practices on daily.dev."}},{"@type":"Question","name":"Why doesn't Kubernetes namespace isolation provide true multi-tenancy?","acceptedAnswer":{"@type":"Answer","text":"Namespace-based isolation in Kubernetes only provides soft multi-tenancy because it relies on a basic trust assumption among tenants sharing a cluster; cluster-scoped resources can still be visible across namespace boundaries if RBAC permissions are misconfigured. Genuine hard multi-tenancy, where one tenant has zero visibility into another, requires dedicated clusters per tenant rather than shared namespaces. Architects weighing namespace isolation against dedicated clusters can compare multi-tenancy approaches on daily.dev."}},{"@type":"Question","name":"What is causing container image bloat and vulnerability risk to increase in Kubernetes environments?","acceptedAnswer":{"@type":"Answer","text":"Image bloat has roughly quintupled and package maintenance has slipped over the past year, per Sysdig's 2025 Cloud-Native Security and Usage Report, driven partly by the rush to build with AI since AI and ML packages are much larger than traditional workloads Kubernetes was built to handle. Robust image security requires scanning at multiple stages: code sourcing, base image verification, signing, admission control, and continuous runtime scanning. Developers hardening container image pipelines against supply-chain risk can follow related coverage on daily.dev."}}]} ```