Detects a possible backdoor via temporary AWS EKS access entry: creation of an EKS access entry (eks:CreateAccessEntry) for the caller and, within a short window (maxspan 5 minutes), deletion of that entry (eks:DeleteAccessEntry) by the same identity. The rule uses AWS CloudTrail events (aws.cloudtrail) from logs-aws.cloudtrail-* and ties the events by aws.cloudtrail.user_identity.arn. If the same ARN creates access to a cluster and the identity later deletes the entry, this can enable Kubernetes RBAC escalation (ClusterRoleBindings, privileged ServiceAccounts, etc.) while removing the cloud-side trace of the initial grant. The detection maps to MITRE ATT&CK Persistence T1098 Account Manipulation (T1098.006 Additional Container Cluster Roles). The rule provides investigative steps and false-positive considerations in its notes, including CI/CD tests and break-glass scenarios.