Enable EKS control plane logging

Méthode de vérification

Méthode d'audit: Commande shell

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.logging.clusterLogging[?enabled==`true`].types[]' --output text) || exit 1
ok=1
for t in api audit authenticator controllerManager scheduler; do
  printf '%s\n' $out | grep -qx "$t" || { echo "noncompliant: $t logging disabled"; ok=0; }
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

From Console: 1. For each EKS Cluster in each region; 2. Go to Amazon Elastic Kubernetes Service > Clusters > CLUSTER_NAME > Observability > Control plane logs 3. Click Manage to enable or disable logging. 4. Ensure that one or more options are toggled to Enabled and Save Changes. o API server: Enabled o Audit: Enabled o Authenticator: Enabled o Controller manager: Enabled o Scheduler: Enabled 5. Click 'Save Changes'. From the AWS CLI: 1. For each EKS Cluster in each region: aws eks update-cluster-config \ --name $CLUSTER_NAME \ --region $REGION_CODE \ --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManage r","scheduler"],"enabled":true}]}'

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target eks