This rule monitors AWS EKS (Kubernetes) audit events for creation or modification of RBAC roles that grant high-risk permissions, such as wildcard verbs/resources or escalation capabilities (e.g., bind, escalate, impersonate). It ingests control-plane audit logs via the AWS EKS integration (logs-aws.eks_audit-*) and evaluates events where Roles or ClusterRoles are created, updated, or patched, with an authorization decision of allow. The detection checks both request and response contexts for breadth, filters out trivial/internal activity (e.g., localhost origins, eks:* identities, and specific system controllers), and flags changes that materially increase privilege. When triggered, it maps to MITRE ATT&CK techniques for Account Manipulation (T1098, with a subtechnique for Additional Container Cluster Roles T1098.006) and to Persistence/Privilege Escalation (TA0003, TA0004). It also provides triage guidance, potential false positives, and remediation steps to contain and recover from possible abuse. The rule is labeled as medium severity and designed to detect attempts to expand cluster-wide access or privilege via RBAC changes that could enable persistence or lateral movement across the cluster.