Break-glass access for Amazon EKS when federated identity fails

This article describes implementing break-glass emergency access for Amazon EKS clusters that functions independently of federated identity providers, enabling cluster recovery when the primary authentication path fails.

• Create a dedicated cross-account IAM role in a separate operations account with mandatory MFA and recency requirements
• Use Amazon EKS Cluster Access Management (CAM) API to pre-provision access entries outside the cluster, avoiding dependency on Kubernetes API access
• Implement authentication through AWS IAM and STS only, bypassing external identity providers entirely
• Validate with both positive tests (successful access with valid MFA) and negative tests (failed access without MFA)
• Include comprehensive audit trails via AWS CloudTrail and Kubernetes audit logs with source identity tracking
• Verify workload identity (IRSA and EKS Pod Identity) separately during post-incident recovery
• Deploy via AWS CloudFormation or Terraform templates with quarterly testing and access reviews

The pattern eliminates circular dependencies by creating an AWS-only authentication chain that survives identity provider outages, enabling operators to diagnose and fix cluster access issues without external system dependencies.