# Service account token authentication should not be used for users

- Source: https://support.icompaas.com/support/solutions/articles/62000234699-service-account-token-authentication-should-not-be-used-for-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Kubernetes Benchmark v1.9.0](https://support.icompaas.com/support/solutions/62000112690) › [CIS Kubernetes Benchmark](https://support.icompaas.com/support/solutions/folders/62000169256)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

-   **Level 1**  
      
    

### Description:

Service account token authentication is a mechanism used in Kubernetes for service accounts to authenticate to the API server. However, using service account tokens for user authentication is not recommended, as it bypasses the intended use of service accounts and creates security risks, such as shared credentials and less granular access control. Instead, users should authenticate using more secure and scalable methods, such as OpenID Connect (OIDC) or integrated identity management systems (e.g., AWS IAM or LDAP).

### Rationale:

Service account tokens are designed for use by applications and services within the cluster, not for human user authentication. Allowing users to authenticate using service account tokens can introduce security vulnerabilities, such as lack of user-specific access control, shared credentials, and difficulties in auditing user actions. Modern authentication methods provide better user identification, access control, and auditability, enhancing cluster security.

### Impact:

Pros:  

-   Improves security by ensuring users authenticate through appropriate mechanisms (e.g., OIDC, IAM).  
    
-   Enables more granular access control and audit logging for user actions.  
    
-   Reduces the risk of users obtaining service account tokens with broader privileges.  
    

Cons:  

-   Requires transitioning users to a more scalable and modern authentication method, which may require configuration changes.  
    

### Default Value:

Service account token authentication is typically not enabled by default for users in most secure Kubernetes setups. However, it may be used if not explicitly configured to disable it.

### Pre-requisites:

-   The Kubernetes cluster should be configured to use alternative authentication methods, such as OIDC or IAM.  
    
-   Users should be migrated to an identity management system that supports more scalable authentication.  
    

### Test Plan:

#### Using AWS Console:

1.  Sign in to the AWS Management Console.  
    
2.  Navigate to your EKS Cluster.  
    
3.  Go to the Kubernetes API server configuration.  
    
4.  Verify that service account token authentication is not enabled for user authentication and that an alternative authentication method (like OIDC or IAM) is used.  
    

#### Using AWS CLI:

Run the following AWS CLI command to describe your EKS cluster's configuration:

aws eks describe-cluster --name <cluster-name> --query "cluster.config"

1.  Ensure that service account token authentication is not listed as the authentication method for users.  
    

### Implementation Plan

#### Using AWS Console:

1.  Navigate to the EKS cluster in the AWS Console.  
    
2.  Under the Cluster Configuration section, review the authentication settings.  
    
3.  Disable service account token authentication for users and enable a more modern authentication method (e.g., OIDC, IAM).  
    
4.  Save the configuration and apply the changes.  
    

#### Using AWS CLI:

Update the authentication settings to disable service account token authentication and enable an alternative method:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --enable-oidc-authentication

### Backout Plan

#### Using AWS Console:

1.  Navigate to the EKS cluster's API server configuration.  
    
2.  If necessary, revert the configuration to re-enable service account token authentication.  
    
3.  Save the configuration and redeploy the cluster.  
    

#### Using AWS CLI:

If issues occur, revert the change using:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --enable-service-account-token-authentication

### References:

-   Kubernetes Authentication Documentation  
    [EKS Cluster Management](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html)[  
    ](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.