Skip to main content

AWS Enable Audit Logs - Security Rule

More Info:​

Enable all EKS control plane log types (API server, audit, authenticator, controller manager, scheduler) so cluster activity is captured. Audit logging being disabled leaves security-relevant events unrecorded.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS EKS
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. List clusters and choose target(s)

    • On any machine with AWS CLI access: 
      aws eks list-clusters --region us-east-1
      aws eks list-clusters --region us-west-2
    • For each cluster you operate, note the regions and cluster names that must comply with this control.

  2. Review current control plane logging configuration

    • For each cluster, on any machine with AWS CLI access: 
      aws eks describe-cluster \
        --region us-east-1 \
        --name CLUSTER_NAME \
        --query 'cluster.logging.clusterLogging'
    • Confirm whether the types array includes all of api, audit, authenticator, controllerManager, scheduler and that they are shown with "enabled": true.

  3. Decide scope and retention strategy

    • Confirm with your security/operations stakeholders:
      • Which clusters must have all control plane log types enabled.
      • The destination and retention for these logs (e.g., CloudWatch log group, log retention policy, access controls).
    • Verify existing log groups and retention: 
      aws logs describe-log-groups --log-group-name-prefix /aws/eks/CLUSTER_NAME

  4. Enable all EKS control plane log types where required

    • For each cluster needing remediation, on any machine with AWS CLI access: 
      aws eks update-cluster-config \
        --region us-east-1 \
        --name CLUSTER_NAME \
        --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'
    • Be aware this change affects the managed control plane; it does not require node restarts but will increase log volume and associated CloudWatch costs.

  5. Verify that logging is fully enabled

    • Re-run the audit on any machine with AWS CLI access: 
      aws eks describe-cluster \
        --region us-east-1 \
        --name CLUSTER_NAME \
        --query 'cluster.logging.clusterLogging'
    • Confirm all five types (api, audit, authenticator, controllerManager, scheduler) appear with "enabled": true and no conflicting "enabled": false entries.

  6. Confirm logs are being received and are usable

    • In the AWS console, for each cluster:
      • Open CloudWatch Logs and locate log groups starting with /aws/eks/CLUSTER_NAME.
      • Confirm that new log streams are appearing and that recent events exist for API, audit, and authenticator activity.
    • Optionally from CLI, spot-check entries: 
      aws logs describe-log-streams \
        --log-group-name /aws/eks/CLUSTER_NAME/cluster \
        --order-by LastEventTime --descending --limit 5
Using kubectl

kubectl cannot enable or configure EKS control plane audit logs, because these settings are managed on the AWS control plane (via the AWS console, CLI, or IaC), not through Kubernetes API objects. Use kubectl only to inspect workload state if needed; perform the actual remediation using the steps in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Check EKS control plane logging status for all clusters in all regions
# Requires: aws CLI configured with appropriate permissions
# Run on: any machine with aws CLI access

set -euo pipefail

# Get all regions that support EKS
regions="$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)"

printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \
  "REGION" "CLUSTER_NAME" "API" "AUDIT" "AUTH" "CTRL-MGR" "SCHEDULER" "STATUS"
printf '%0.s-' {1..130}; echo

for region in $regions; do
  clusters="$(aws eks list-clusters --region "$region" --query 'clusters[]' --output text || true)"
  [ -z "$clusters" ] && continue

  for cluster in $clusters; do
    # Get logging config
    cfg="$(aws eks describe-cluster \
      --region "$region" \
      --name "$cluster" \
      --query 'cluster.logging.clusterLogging' \
      --output json)"

    # Default all to disabled
    api=disabled
    audit=disabled
    auth=disabled
    ctrl=disabled
    sched=disabled

    # Parse enabled types
    enabled_types="$(echo "$cfg" | jq -r '.[] | select(.enabled==true) | .types[]' 2>/dev/null || true)"

    for t in $enabled_types; do
      case "$t" in
        api)               api=enabled ;;
        audit)             audit=enabled ;;
        authenticator)     auth=enabled ;;
        controllerManager) ctrl=enabled ;;
        scheduler)         sched=enabled ;;
      esac
    done

    status="OK"
    if [ "$api" = disabled ] || [ "$audit" = disabled ] || [ "$auth" = disabled ] || \
       [ "$ctrl" = disabled ] || [ "$sched" = disabled ]; then
      status="MISSING"
    fi

    printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \
      "$region" "$cluster" "$api" "$audit" "$auth" "$ctrl" "$sched" "$status"
  done
done

How to interpret the output

  • Focus on the STATUS column:
    • OK – all five log types (API, AUDIT, AUTH, CTRL-MGR, SCHEDULER) are enabled.
    • MISSING – at least one of the required log types is disabled; this indicates a problem that needs manual review and remediation via the AWS Console or aws eks update-cluster-config.