This rule detects modifications to an existing Role or ClusterRole that result in wildcard (star) permissions for all verbs and resources, a pattern indicative of potential privilege escalation or deliberate breadth expansion within Kubernetes RBAC on AWS EKS. It specifically analyzes EKS control-plane audit logs ingested via the AWS integration (aws.eks_audit.*) and normalized under aws.eks.audit.*. The detections trigger when an update or patch operation targets roles with wildcard verbs/resources, accompanied by non-loopback source IPs, an allow decision annotation (authorization.k8s.io/decision == "allow"), and a RequestResponse lifecycle. The rule then surfaces relevant details (user, source IP, verb, resource type/name, request URI, RBAC bindings) to aid investigation of who changed access and how. Investigative triage steps include diffing the Role/ClusterRole YAML, identifying RoleBindings/ClusterRoleBindings referencing the affected role, and checking for additional RBAC changes or sensitive reads/exec actions from the same identity. False positives can occur in GitOps or vendor upgrade scenarios that legitimately widen permissions; baselined automation may be allowlisted with proper documentation. Remediation involves reverting the wildcard change, removing unintended bindings, rotating credentials for the actor, and blocking future wildcard RBAC outside policy-governed pipelines (policy-as-code, PR-only RBAC). The rule maps to MITRE ATT&CK TA0004 Privilege Escalation, specifically T1098.006 Additional Container Cluster Roles, reflecting privilege elevation within Kubernetes RBAC. The rule emphasizes validating the actor, client, and source, and coordinating changes with change records to reduce misconfiguration risk.