Control: 8 EKS clusters should have audit logging enabled
Description
This control checks whether an Amazon EKS cluster has audit logging enabled. The control fails if audit logging isn't enabled for the cluster.
EKS control plane logging provides audit and diagnostic logs directly from the EKS control plane to Amazon CloudWatch Logs in your account. You can select the log types you need, and logs are sent as log streams to a group for each EKS cluster in CloudWatch. Logging provides visibility into the access and performance of EKS clusters. By sending EKS control plane logs for your EKS clusters to CloudWatch Logs, you can record operations for audit and diagnostic purposes in a central location.
Remediation
To enable audit logs for your EKS cluster, see Enabling and disabling control plane logs in the Amazon EKS User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_eks_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_eks_8 --shareSQL
This control uses a named query:
eks_cluster_control_plane_audit_logging_enabled