Detects creation of Kubernetes service account tokens via the TokenRequest API (serviceaccounts/token subresource) in AWS EKS by non-system identities. TokenRequest allows programmatic generation of short-lived tokens for service accounts with create permissions, without mounting tokens on the filesystem. Attackers with initial cluster access can abuse this to mint tokens for privileged service accounts (including IRSA/workload identity tokens) and pivot to cloud APIs or create long-lived credentials that persist beyond pod termination. Unlike mounted tokens, TokenRequest tokens have no filesystem footprint and are only visible in Kubernetes audit logs as a create on the token subresource. The rule excludes legitimate system components that routinely create tokens (e.g., kubelet, kube-controller-manager, EKS managed identities, tigera/calico operators).