Detects creation events of Kubernetes RBAC bindings that grant permissions to a ServiceAccount by monitoring AWS EKS control-plane audit logs (data_stream: aws.eks_audit). The rule fires when a RoleBinding or ClusterRoleBinding is created (verb: create) with a subject of kind ServiceAccount, and the binding references a Role or ClusterRole. It only triggers when the AWS EKS audit entry shows the authorization decision as allow, indicating that the binding was permitted by Kubernetes. This can indicate privilege delegation or misconfiguration that may lead to elevated access or persistence within the cluster. The logic is implemented as a Kuery query against the eks audit dataset (data_stream.dataset: