# Ensure that the admission control plugin ServiceAccount is set

- Source: https://support.icompaas.com/support/solutions/articles/62000234614-ensure-that-the-admission-control-plugin-serviceaccount-is-set
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Kubernetes Benchmark v1.9.0](https://support.icompaas.com/support/solutions/62000112690) › [CIS Kubernetes Benchmark](https://support.icompaas.com/support/solutions/folders/62000169256)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

-   **Level 2**  
      
    

### Description:

The ServiceAccount admission control plugin is responsible for automatically creating and associating service accounts with Pods that do not explicitly specify a service account. This ensures that all Pods have an associated service account, which provides identity and access management to the API server.

### Rationale:

By enabling the ServiceAccount admission control plugin, you ensure that every Pod in the cluster, even those that do not explicitly request one, has a valid service account associated. This is important for ensuring proper access control and authentication for applications running inside the Pods. The default service account is used for Pods that do not specify one.

### Impact:

Pros:  

-   Ensures every Pod has a service account, improving identity and access management.  
    
-   Helps avoid accidental or unintended Pods running without the appropriate permissions.  
    

Cons:  

-   If not configured properly, it might lead to the use of default service accounts with excessive privileges, which could pose a security risk.  
    

### Default Value:

The ServiceAccount admission control plugin is typically enabled by default, but it should be verified to ensure it is active.

### Pre-requisites:

-   Service accounts must be defined in the Kubernetes cluster if custom accounts are needed.  
    
-   The admission control configuration must allow for the creation of service accounts by the API server.  
    

### Test Plan:

#### Using AWS Console:

1.  Sign in to the AWS Management Console.  
    
2.  Navigate to your EKS Cluster.  
    
3.  Go to the Node Group or EKS configuration details.  
    
4.  Check the \--enable-admission-plugins flag and verify that ServiceAccount is listed among the enabled plugins.
    

#### Using AWS CLI:

Run the following AWS CLI command to describe your EKS cluster's configuration:

aws eks describe-cluster --name <cluster-name> --query "cluster.config"

1.  Ensure that ServiceAccount is listed under \--enable-admission-plugins.  
    

### Implementation Plan:

#### Using AWS Console:

1.  Navigate to the EKS cluster in the AWS Console.  
    
2.  Under the Cluster Configuration section, modify the API server's settings.  
    
3.  Ensure that the ServiceAccount admission control plugin is enabled.
    
4.  Save the configuration and apply the changes.  
    

#### Using AWS CLI:

Update the \--enable-admission-plugins argument to include ServiceAccount:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --enable-admission-plugins ServiceAccount

### Backout Plan

#### Using AWS Console:

1.  Navigate to the EKS cluster's API server configuration.  
    
2.  If necessary, remove ServiceAccount from the list of enabled admission control plugins.
    
3.  Save the configuration and redeploy the cluster.  
    

#### Using AWS CLI:

If issues occur, revert the change using:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --disable-admission-plugins ServiceAccount

### References:

-   Kubernetes Admission Control Documentation  
    
-   [EKS Cluster Management](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.