> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Enable Audit Logs ### More Info: Enable all EKS control plane log types (API server, audit, authenticator, controller manager, scheduler) so cluster activity is captured. Audit logging being disabled leaves security-relevant events unrecorded. ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CIS EKS * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation 1. **List clusters and choose target(s)** * On any machine with AWS CLI access: ```bash theme={null} aws eks list-clusters --region us-east-1 aws eks list-clusters --region us-west-2 ``` * For each cluster you operate, note the regions and cluster names that must comply with this control. 2. **Review current control plane logging configuration** * For each cluster, on any machine with AWS CLI access: ```bash theme={null} aws eks describe-cluster \ --region us-east-1 \ --name CLUSTER_NAME \ --query 'cluster.logging.clusterLogging' ``` * Confirm whether the `types` array includes all of `api`, `audit`, `authenticator`, `controllerManager`, `scheduler` and that they are shown with `"enabled": true`. 3. **Decide scope and retention strategy** * Confirm with your security/operations stakeholders: * Which clusters must have *all* control plane log types enabled. * The destination and retention for these logs (e.g., CloudWatch log group, log retention policy, access controls). * Verify existing log groups and retention: ```bash theme={null} aws logs describe-log-groups --log-group-name-prefix /aws/eks/CLUSTER_NAME ``` 4. **Enable all EKS control plane log types where required** * For each cluster needing remediation, on any machine with AWS CLI access: ```bash theme={null} aws eks update-cluster-config \ --region us-east-1 \ --name CLUSTER_NAME \ --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}' ``` * Be aware this change affects the managed control plane; it does not require node restarts but will increase log volume and associated CloudWatch costs. 5. **Verify that logging is fully enabled** * Re-run the audit on any machine with AWS CLI access: ```bash theme={null} aws eks describe-cluster \ --region us-east-1 \ --name CLUSTER_NAME \ --query 'cluster.logging.clusterLogging' ``` * Confirm all five types (`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`) appear with `"enabled": true` and no conflicting `"enabled": false` entries. 6. **Confirm logs are being received and are usable** * In the AWS console, for each cluster: * Open **CloudWatch Logs** and locate log groups starting with `/aws/eks/CLUSTER_NAME`. * Confirm that new log streams are appearing and that recent events exist for API, audit, and authenticator activity. * Optionally from CLI, spot-check entries: ```bash theme={null} aws logs describe-log-streams \ --log-group-name /aws/eks/CLUSTER_NAME/cluster \ --order-by LastEventTime --descending --limit 5 ``` kubectl cannot enable or configure EKS control plane audit logs, because these settings are managed on the AWS control plane (via the AWS console, CLI, or IaC), not through Kubernetes API objects. Use kubectl only to inspect workload state if needed; perform the actual remediation using the steps in the **Manual Steps** section. ```bash theme={null} #!/usr/bin/env bash # Check EKS control plane logging status for all clusters in all regions # Requires: aws CLI configured with appropriate permissions # Run on: any machine with aws CLI access set -euo pipefail # Get all regions that support EKS regions="$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)" printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \ "REGION" "CLUSTER_NAME" "API" "AUDIT" "AUTH" "CTRL-MGR" "SCHEDULER" "STATUS" printf '%0.s-' {1..130}; echo for region in $regions; do clusters="$(aws eks list-clusters --region "$region" --query 'clusters[]' --output text || true)" [ -z "$clusters" ] && continue for cluster in $clusters; do # Get logging config cfg="$(aws eks describe-cluster \ --region "$region" \ --name "$cluster" \ --query 'cluster.logging.clusterLogging' \ --output json)" # Default all to disabled api=disabled audit=disabled auth=disabled ctrl=disabled sched=disabled # Parse enabled types enabled_types="$(echo "$cfg" | jq -r '.[] | select(.enabled==true) | .types[]' 2>/dev/null || true)" for t in $enabled_types; do case "$t" in api) api=enabled ;; audit) audit=enabled ;; authenticator) auth=enabled ;; controllerManager) ctrl=enabled ;; scheduler) sched=enabled ;; esac done status="OK" if [ "$api" = disabled ] || [ "$audit" = disabled ] || [ "$auth" = disabled ] || \ [ "$ctrl" = disabled ] || [ "$sched" = disabled ]; then status="MISSING" fi printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \ "$region" "$cluster" "$api" "$audit" "$auth" "$ctrl" "$sched" "$status" done done ``` **How to interpret the output** * Focus on the `STATUS` column: * `OK` – all five log types (`API`, `AUDIT`, `AUTH`, `CTRL-MGR`, `SCHEDULER`) are `enabled`. * `MISSING` – at least one of the required log types is `disabled`; this indicates a problem that needs manual review and remediation via the AWS Console or `aws eks update-cluster-config`.