Control: GuardDuty EKS runtime monitoring should be enabled
Description
This control checks whether GuardDuty EKS runtime monitoring with automated agent management is enabled. For a standalone account, the control fails if GuardDuty EKS runtime monitoring with automated agent management is disabled in the account. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts don't have EKS runtime monitoring with automated agent management enabled.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.guardduty_detector_eks_runtime_monitoring_enabled
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.guardduty_detector_eks_runtime_monitoring_enabled --share
SQL
This control uses a named query:
with eks_runtime_monitoring as ( select arn from aws_guardduty_detector, jsonb_array_elements(features) as f where f ->> 'Name' = 'EKS_RUNTIME_MONITORING' and f ->> 'Status' = 'ENABLED')select d.arn as resource, case when m.arn is not null then 'ok' else 'alarm' end as status, case when m.arn is not null then title || ' has EKS runtime monitoring enabled.' else title || ' has EKS runtime monitoring disabled.' end as reason , region, account_idfrom aws_guardduty_detector as d left join eks_runtime_monitoring as m on m.arn = d.arn