Skip to main content

🛡️ AWS EKS Cluster Logging is not enabled for all control plane logs types🟢

Logic​

Similar Policies​

  • Internal: dec-x-8ccccedc

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-8ccccedc1

Description​

Open File

Description​

EKS control plane logging enables the delivery of audit and diagnostic logs directly from the EKS control plane to Amazon CloudWatch Logs within your account. The following log types are available:

  • API Server - Includes logs that capture API server flags used during the server’s startup.
  • Audit - Kubernetes audit logs capturing actions performed by users, administrators, or system components that affect your cluster.
  • Authenticator - Specific to Amazon EKS, these logs capture the control plane’s authentication activity using IAM credentials for Kubernetes RBAC.
  • Controller Manager - Logs from the component responsible for running core control loops that regulate cluster state.
  • Scheduler - Captures events from the scheduler, which determines placement and scheduling of Pods within the cluster.

Rational​

Enabling EKS control plane logging is essential for security auditing, regulatory compliance, and operational diagnostics. These logs offer visibility into key events and system behavior, allowing you to detect unauthorized access, trace configuration changes, identify performance issues, and respond to incidents. Without them, understanding who made changes, when they occurred, and their impact becomes significantly more challenging, resulting in critical blind spots.

... see more

Remediation​

Open File

Remediation​

From Command Line​

To enable control plane logging for your Amazon EKS cluster, update the logging configuration with the following command:

aws eks update-cluster-config \
    --region {{region-code}} \
    --name {{cluster-name}} \
    --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 APRA CPG 234 → 💼 67d logging and alerting of access to sensitive data or unsuccessful logon attempts to identify potential unauthorised access;22no data
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;89no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.8] EKS clusters should have audit logging enabled1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration71no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)18no data
💼 FedRAMP High Security Controls → 💼 AC-2(12) Account Monitoring for Atypical Usage (M)(H)13no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)728no data
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)22no data
💼 FedRAMP High Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)133no data
💼 FedRAMP High Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)13no data
💼 FedRAMP High Security Controls → 💼 AU-6(4) Central Review and Analysis (H)13no data
💼 FedRAMP High Security Controls → 💼 AU-10 Non-repudiation (H)12no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)269no data
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)222no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)435no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145058no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4853no data
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)22no data
💼 FedRAMP Low Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)19no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)69no data
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)122no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)9no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(12) Account Monitoring for Atypical Usage (M)(H)3no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)28no data
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)133no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)13no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)69no data
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)222no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)219no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)711no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities44no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources59no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events161no data
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events22no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events94no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events44no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events162no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations36no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties50no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities51no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded40no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked39no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions1418no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(12) Account Management _ Account Monitoring for Atypical Usage2no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions14no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1721no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging422no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records31333no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories13no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis13no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-9(7) Protection of Audit Information _ Store on Component with Different Operating System1no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-10 Non-repudiation512no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44769no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring622no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81735no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic25no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands9no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25113no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(20) System Monitoring _ Privileged Users8no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events13no data
💼 PCI DSS v3.2.1 → 💼 10.2 Implement automated audit trails for all system components.7630no data
💼 PCI DSS v4.0.1 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.729no data
💼 PCI DSS v4.0 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.7129no data