Ensure Audit Logs Are Collected And Managed

#!/usr/bin/env bash
# Purpose: Report EKS control plane audit logging configuration and
#          basic in-cluster audit log forwarding setup.
# Runs on: any machine with kubectl access and AWS CLI configured.

set -euo pipefail

echo "=== 1. EKS CONTROL PLANE AUDIT LOGGING (CLOUDTRAIL / CLOUDWATCH) ==="

# List all clusters and show which have audit logging enabled
aws eks list-clusters --output text | awk '{print $2}' | while read -r CLUSTER; do
  if [ -z "$CLUSTER" ]; then
    continue
  fi
  echo "Cluster: $CLUSTER"
  aws eks describe-cluster --name "$CLUSTER" \
    --query 'cluster.logging.clusterLogging[?types!=`[]`]' \
    --output table || echo "  ERROR: unable to describe cluster $CLUSTER"

  echo
done

cat <<'EOF'

Interpretation (control plane logging):
- Problem indicators:
  - No entry where "types" contains "audit".
  - "enabled" is false for the logging entry that includes "audit".
- Healthy indicators:
  - At least one entry with "types" containing "audit" and "enabled" = true.

NOTE: Enabling EKS control plane audit logging is done via AWS console/CLI/IaC,
      not via kubectl or node-level changes.

EOF

echo "=== 2. IN-CLUSTER AUDIT POLICY CONFIGMAP (kube-system) ==="

# Check for a commonly used audit policy ConfigMap name
CM_NAMES=("cluster-audit-policy" "audit-policy" "kube-audit-policy")

for CM in "${CM_NAMES[@]}"; do
  echo "Checking for ConfigMap: $CM in kube-system..."
  if kubectl get configmap "$CM" -n kube-system >/dev/null 2>&1; then
    echo "  FOUND: $CM"
    echo "  --- audit-policy.yaml from $CM ---"
    kubectl get configmap "$CM" -n kube-system -o jsonpath='{.data.audit-policy\.yaml}' 2>/dev/null \
      || echo "  WARN: ConfigMap exists but does not contain key 'audit-policy.yaml'"
    echo
  else
    echo "  MISSING: $CM"
  fi
  echo
done

cat <<'EOF'

Interpretation (policy ConfigMap):
- Problem indicators:
  - No ConfigMap found that contains an audit policy (e.g. cluster-audit-policy).
  - ConfigMap exists but has no 'audit-policy.yaml' key or is effectively empty.
- Healthy indicators:
  - A ConfigMap exists with an 'audit-policy.yaml' key containing a non-trivial
    policy (appropriate levels and resources as per your org standard).

EOF

echo "=== 3. IN-CLUSTER AUDIT LOG FORWARDER PODS (kube-system) ==="

# Look for pods that appear to forward audit logs (by name or label)
echo "Pods in kube-system potentially related to audit log forwarding:"
kubectl get pods -n kube-system -o wide | egrep -i 'audit|log|forward|fluent|filebeat|logstash' || \
  echo "  No obvious audit/log forwarder pods detected by name pattern."

echo
echo "Checking for example 'audit-logging' pod from benchmark remediation:"
kubectl get pod audit-logging -n kube-system -o yaml 2>/dev/null || \
  echo "  Pod 'audit-logging' not found in kube-system."

cat <<'EOF'

Interpretation (forwarder pods):
- Problem indicators:
  - No pods in kube-system with names suggesting log forwarding
    (e.g., fluentd, fluent-bit, filebeat, log-forwarder, audit-logging).
  - The 'audit-logging' pod (if used) is missing or not Running/Ready.
- Healthy indicators:
  - A dedicated log forwarder DaemonSet/Deployment is present and Running,
    and is known (by your ops standards) to ship audit logs to a central
    system (CloudWatch, Elasticsearch, etc.).

EOF

echo "=== 4. NODE-LEVEL INSPECTION (KUBELET / APISERVER AUDIT FLAGS) ==="
cat <<'EOF'

This part cannot be automated cluster-wide with kubectl alone because:
- EKS control plane is managed; you cannot inspect API server flags via nodes.
- Worker nodes usually do not run the control plane and have no direct access
  to control plane audit logs.

Manual checks to perform on each control plane node (for non-managed clusters):
- Verify that the API server is started with:
  --audit-policy-file=</path/to/audit-policy.yaml>
  --audit-log-path=</path/to/audit.log>
  --audit-log-maxage / --audit-log-maxbackup / --audit-log-maxsize set properly.
- Confirm audit log files exist and are being written.
- Confirm your node or sidecar agents (e.g., Fluent Bit, Filebeat) are
  configured to ship these audit logs to your centralized logging system.

EOF