Detects updates to the ephemeralcontainers subresource of pods initiated by a non-system identity in AWS EKS by analyzing AWS EKS audit logs (aws.eks_audit). Ephemeral containers are commonly used for debugging (kubectl debug) but can be abused to inject tooling into a running pod, read mounted secrets, or execute commands in the target pod context. If abused, such actions can enable privilege escalation, lateral movement, or persistence without deploying a new workload. The rule triggers on updates/patches to pods.ephemeralcontainers where authorization_k8s_io/decision is allow, and excludes system/service accounts to reduce noise from legitimate cluster automation.