📝 AWS EKS Cluster Logging is not enabled for all control plane logs types 🟢

• Contextual name: 📝 Cluster Logging is not enabled for all control plane logs types 🟢
• ID: /ce/ca/aws/eks/cluster-logging
• Located in: 📁 AWS EKS

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • RELIABILITY

Similar Policies

• Internal
  • dec-x-8ccccedc

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-8ccccedc	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS EKS Cluster
  • 🔌 AWS EKS Cluster - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

EKS control plane logging enables the delivery of audit and diagnostic logs directly from the EKS control plane to Amazon CloudWatch Logs within your account. The following log types are available:

• API Server - Includes logs that capture API server flags used during the server’s startup.
• Audit - Kubernetes audit logs capturing actions performed by users, administrators, or system components that affect your cluster.
• Authenticator - Specific to Amazon EKS, these logs capture the control plane’s authentication activity using IAM credentials for Kubernetes RBAC.
• Controller Manager - Logs from the component responsible for running core control loops that regulate cluster state.
• Scheduler - Captures events from the scheduler, which determines placement and scheduling of Pods within the cluster.

Rational

Enabling EKS control plane logging is essential for security auditing, regulatory compliance, and operational diagnostics. These logs offer visibility into key events and system behavior, allowing you to detect unauthorized access, trace configuration changes, identify performance issues, and respond to incidents. Without them, understanding who made changes, when they occurred, and their impact becomes significantly more challenging, resulting in critical blind spots.

... see more

Remediation

Open File

Remediation

From Command Line

To enable control plane logging for your Amazon EKS cluster, update the logging configuration with the following command:

aws eks update-cluster-config \
    --region {{region-code}} \
    --name {{cluster-name}} \
    --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		19	22
💼 APRA CPG 234 → 💼 67d logging and alerting of access to sensitive data or unsuccessful logon attempts to identify potential unauthorised access;		2	2
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;		8	9
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			50
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)		1	14
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)		7	24
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		48
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	4		22
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		47	49
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			48
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			14
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)			24
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			48
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	2		18
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			85
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			60
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			91
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			25
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions		12	14
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions		16	17
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	46	48
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control	8	16	22