# Break-glass access for Amazon EKS when federated identity fails

DevFeed: [Break-glass access for Amazon EKS when federated identity fails](<https://devfeed.tech/articles/break-glass-access-for-amazon-eks-when-federated-identity-fails-4625.md>)

Original publisher: [Read original article](<https://aws.amazon.com/blogs/containers/break-glass-access-for-amazon-eks-when-federated-identity-fails/>)

Author: Sam Mukherjee

Published: 2026-08-26T16:20:28Z

Content type: article

Language: en

Sources: [Containers](<https://devfeed.tech/sources/containers.md>)

Topics: [Amazon EKS](<https://devfeed.tech/topics/amazon-eks.md>), [AWS Identity and Access Management (IAM)](<https://devfeed.tech/topics/aws-identity-and-access-management-iam.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [iac-security](<https://devfeed.tech/topics/iac-security.md>), [migration](<https://devfeed.tech/topics/migration.md>)

Tags: [advanced-300](<https://devfeed.tech/tags/advanced-300.md>), [amazon-eks](<https://devfeed.tech/tags/amazon-eks.md>), [amazon-elastic-kubernetes-service](<https://devfeed.tech/tags/amazon-elastic-kubernetes-service.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [identity-and-access-management](<https://devfeed.tech/tags/identity-and-access-management.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [migration](<https://devfeed.tech/tags/migration.md>), [technical-how-to](<https://devfeed.tech/tags/technical-how-to.md>)

## AI overview

This post presents a break-glass access pattern for Amazon EKS clusters when a federated identity provider fails. It describes a dedicated cross-account IAM role with enforced, recency-aware MFA, infrastructure-as-code templates, validation tests, and post-incident recovery procedures.

## Source excerpt

Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure.