Detects modifications to the aws-auth ConfigMap in Amazon EKS clusters by monitoring the AWS EKS control-plane audit logs. The aws-auth ConfigMap maps IAM roles and users to Kubernetes RBAC groups; altering it can grant privileged access (e.g., cluster-admin via the system:masters group) and is a well-known persistence mechanism that survives pod restarts, node replacements, and RBAC changes because the authentication mapping lives outside normal Kubernetes objects. The rule watches the aws.eks_audit data stream for changes to the aws-auth ConfigMap in the kube-system namespace, filtering for update/patch/delete operations where the audit annotation authorization_k8s_io/decision is