Enable EKS control plane logging

СредњаНиво 1Аутоматскаeks

Опис

Enable control plane logging in Amazon EKS to provide visibility into the operation of the managed Kubernetes control plane and activity processed through its core components. Control plane logs create a persistent record of administrative activity, authentication events, scheduling behavior, and other platform operations to support monitoring, troubleshooting, investigation, and accountability. Requires the aws CLI with eks:DescribeCluster; the cluster comes from EKS_CLUSTER and the region from AWS_REGION/AWS_PROFILE. All five control plane log types must be enabled.

Како се проверава

Метод провере: Команда љуске

shell

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.logging.clusterLogging[?enabled==`true`].types[]' --output text) || exit 1
ok=1
for t in api audit authenticator controllerManager scheduler; do
  printf '%s\n' $out | grep -qx "$t" || { echo "noncompliant: $t logging disabled"; ok=0; }
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

From Console: 1. For each EKS Cluster in each region; 2. Go to Amazon Elastic Kubernetes Service > Clusters > CLUSTER_NAME > Observability > Control plane logs 3. Click Manage to enable or disable logging. 4. Ensure that one or more options are toggled to Enabled and Save Changes. o API server: Enabled o Audit: Enabled o Authenticator: Enabled o Controller manager: Enabled o Scheduler: Enabled 5. Click 'Save Changes'. From the AWS CLI: 1. For each EKS Cluster in each region: aws eks update-cluster-config \ --name $CLUSTER_NAME \ --region $REGION_CODE \ --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManage r","scheduler"],"enabled":true}]}'

Својства

Оперативни системи: Било који
Ознаке: ekscontrol-planelogging
Референца: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 2.1.1 Enable EKS control plane logging

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target eks