Skip to main content

⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 AWS → 📁 EKS

🛡️ AWS EKS Cluster Logging is not enabled for all control plane logs types🟢

Logic​

Similar Policies​

  • Internal: dec-x-8ccccedc

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-8ccccedc1

Description​

Open File

Description​

EKS control plane logging enables the delivery of audit and diagnostic logs directly from the EKS control plane to Amazon CloudWatch Logs within your account. The following log types are available:

  • API Server - Includes logs that capture API server flags used during the server’s startup.
  • Audit - Kubernetes audit logs capturing actions performed by users, administrators, or system components that affect your cluster.
  • Authenticator - Specific to Amazon EKS, these logs capture the control plane’s authentication activity using IAM credentials for Kubernetes RBAC.
  • Controller Manager - Logs from the component responsible for running core control loops that regulate cluster state.
  • Scheduler - Captures events from the scheduler, which determines placement and scheduling of Pods within the cluster.

Rational​

Enabling EKS control plane logging is essential for security auditing, regulatory compliance, and operational diagnostics. These logs offer visibility into key events and system behavior, allowing you to detect unauthorized access, trace configuration changes, identify performance issues, and respond to incidents. Without them, understanding who made changes, when they occurred, and their impact becomes significantly more challenging, resulting in critical blind spots.

... see more

Remediation​

Open File

Remediation​

From Command Line​

To enable control plane logging for your Amazon EKS cluster, update the logging configuration with the following command:

aws eks update-cluster-config \
    --region {{region-code}} \
    --name {{cluster-name}} \
    --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 APRA CPG 234 → 💼 67d logging and alerting of access to sensitive data or unsuccessful logon attempts to identify potential unauthorised access;22no data
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;89no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration59no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)16no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)726no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)265no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)425no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4851no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)219no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events118no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events81no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events137no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked28no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions1416no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1719no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44765no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81725no data